Checkmarx report field Id (User Object) as FLS Create violation whenever the code checks for OwnerId (Account Object) field is createable. Is it false-positive result or can I enforce FLS somehow to avoid the reported issue?

FLS Create result path 1:

Object: id in file: classes/UserHandler.cls
L 99: OwnerId = user.Id,

2 Answers 2


Checkmarx is not "useless," and, in fact, is very good at what it does. However, that's not to say that false positives are not possible. It can make mistakes. However, whenever you get a flag like this, you should check and see if it is a legitimate problem or not. If it is a false positive, document it and go on. Flags are not automatic rejections for purposes of the security review, they just require extra checking by the security team to verify the false positive.

  • Nice explanation @sfdcfox. In my experience this tool make more mistakes that I expect. When I move checks to utils class and wrap them into seperate methods Checkmarx threat them as non existing. Sep 26, 2018 at 20:15
  • @gpoluch Without seeing a specific example, I can't really anything for sure, but it should generally pick those up. If it's a constant problem, it's probably a bug they know about. If you really wanted to confirm, you could always open a ticket with their support and log a bug.
    – sfdcfox
    Sep 26, 2018 at 20:19

I don't know anything about checkmarx but you can test if the user has access to the ownerId field prior to putting a value into that field.



You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .