1 
if(dupObjDel !=null && dupObjDel.size() > 0 ) {  
    if(isSafeObjectDel( dupObjDel ) ) {               
        delete dupObjDel;  // ERROR in this line
    }                  
}

public static boolean isSafeObjectDel(List<sobject> delId) {
     boolean result=false;
     Sobject del =delId[0];
     String objName= del.id.getSObjectType().getDescribe().getName();
     return isDeletable(objName);

}

public static Boolean isDeletable(String sObjectType)
{
    SObjectType schemaType = Schema.getGlobalDescribe().get(sObjectType);
    return (schemaType.getDescribe().isAccessible() && schemaType.getDescribe().isDeletable() && schemaType.getDescribe().isMergeable());
}

ERROR Object: dupobjdel in file: /classes/CustomMerge.cls

Send this code to checkmarks. Error:

CRUD Delete error from security review.

Improve this question
2
  • Seems like a false positive to me, though I'll admit that I've not used the checkmarx security scanner myself. The only thing I can think of that wouldn't make this a false positive is if Salesforce wants you to check if the running user has access to all of the records you're trying to delete.
    – Derek F
    Jul 31, 2017 at 14:30
  • On a different note you can probably do away with that secondary isDeletable() method. The getSObjectType() method of the List class can fetch the type, and then you can call getDescribe() on that directly (which is faster than getGlobalDescribe()). Store the result in a variable, and then you'll be able to call isAccessible(), isDeletable(), etc... a bit more efficiently too. The only situation I can think of where this wouldn't be safe is if you tried to do this on a List<SObject> that contained more than one type of SObject.
    – Derek F
    Jul 31, 2017 at 14:37

1 Answer 1

Reset to default
1

This is a false positive. In general, Checkmarx is not going to be able to understand patterns like this, given our current queries for CRUD/FLS.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .