0

Checkmarx report field Id (User Object) as FLS Create violation whenever the code checks for OwnerId (Account Object) field is createable. Is it false-positive result or can I enforce FLS somehow to avoid the reported issue?

FLS Create result path 1:

Object: id in file: classes/UserHandler.cls
L 99: OwnerId = user.Id,
4

Checkmarx is not "useless," and, in fact, is very good at what it does. However, that's not to say that false positives are not possible. It can make mistakes. However, whenever you get a flag like this, you should check and see if it is a legitimate problem or not. If it is a false positive, document it and go on. Flags are not automatic rejections for purposes of the security review, they just require extra checking by the security team to verify the false positive.

  • Nice explanation @sfdcfox. In my experience this tool make more mistakes that I expect. When I move checks to utils class and wrap them into seperate methods Checkmarx threat them as non existing. – gpoluch Sep 26 '18 at 20:15
  • @gpoluch Without seeing a specific example, I can't really anything for sure, but it should generally pick those up. If it's a constant problem, it's probably a bug they know about. If you really wanted to confirm, you could always open a ticket with their support and log a bug. – sfdcfox Sep 26 '18 at 20:19
0

I don't know anything about checkmarx but you can test if the user has access to the ownerId field prior to putting a value into that field.

Schema.sObjectType.Contact.fields.OwnerId.isAccessible()

Docs

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.