1

Checkmarx report field Id (User Object) as FLS Create violation whenever the code checks for OwnerId (Account Object) field is createable. Is it false-positive result or can I enforce FLS somehow to avoid the reported issue? 

FLS Create result path 1:

Object: id in file: classes/UserHandler.cls
L 99: OwnerId = user.Id,
Improve this question

2 Answers 2

Reset to default
5

Checkmarx is not "useless," and, in fact, is very good at what it does. However, that's not to say that false positives are not possible. It can make mistakes. However, whenever you get a flag like this, you should check and see if it is a legitimate problem or not. If it is a false positive, document it and go on. Flags are not automatic rejections for purposes of the security review, they just require extra checking by the security team to verify the false positive.

Improve this answer
2
  • Nice explanation @sfdcfox. In my experience this tool make more mistakes that I expect. When I move checks to utils class and wrap them into seperate methods Checkmarx threat them as non existing.
    – Grzegorz Połuch
    Commented Sep 26, 2018 at 20:15
  • @gpoluch Without seeing a specific example, I can't really anything for sure, but it should generally pick those up. If it's a constant problem, it's probably a bug they know about. If you really wanted to confirm, you could always open a ticket with their support and log a bug.
    – sfdcfox ♦
    Commented Sep 26, 2018 at 20:19
0

I don't know anything about checkmarx but you can test if the user has access to the ownerId field prior to putting a value into that field.

Schema.sObjectType.Contact.fields.OwnerId.isAccessible()

Docs

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .