My code on scanner report gives some FLS Create errors code like this

public static cg__SURL__c upsertPublicLink(cg__SURL__c sUrl){

    if (String.isEmpty(sURL.cg__SUrl_Id__c)) {
        String baseURL = (String) SDriveConfigUtil.getSdriveConfigValue('BaseURL');
        if( !baseURL.endsWith('/') )
            baseURL += '/';
        //AS: isCreateable & isUpdateable() are added.
        if (Schema.sObjectType.cg__SURL__c.fields.cg__SUrl_Id__c.isCreateable() &&  Schema.sObjectType.cg__SURL__c.fields.cg__SUrl_Id__c.isUpdateable())
            sURL.cg__SUrl_Id__c = sUrlController.createKeyForSUrl();
        if (Schema.sObjectType.cg__SURL__c.fields.cg__Short_URL__c.isCreateable() &&  Schema.sObjectType.cg__SURL__c.fields.cg__Short_URL__c.isUpdateable())
            sURL.cg__Short_URL__c = baseURL + sURL.cg__SUrl_Id__c;


    upsert sUrl;
    return sUrl;

They show those type of errors on the report;

Object: cg__surl_id__c in file: classes/sUrlController.cls
L 384: sURL.cg__SUrl_Id__c = sUrlController.createKeyForSUrl();
Object: surl in file: classes/sUrlController.cls
L 390: upsert sUrl;

Object: cg__short_url__c in file: classes/sUrlController.cls
L 386: sURL.cg__Short_URL__c = baseURL + sURL.cg__SUrl_Id__c;
Object: surl in file: classes/sUrlController.cls
L 390: upsert sUrl;

I don't understand what I did wrong, I believe if clauses for both Line 384 and 386 are true. Should I add or delete or even change something in this piece of code?

  • 1
    It might be just a false positive Commented Dec 18, 2018 at 20:37
  • As a newbie, how can I be sure that it is false positive. It seems hard to follow which of them accepted which of them are not (there are 80 fls create issues on the report). So, I can't be sure whether it is false positive or it does not fit to FLS create rules. Commented Dec 18, 2018 at 20:41
  • 2
    AFAIK as long as you're looking for the access checks like Schema.sObjectType.cg__SURL__c.fields.cg__SUrl_Id__c.isUpdateable(), I guess you should be fine! Commented Dec 18, 2018 at 20:44
  • @codeyinthecloud Should I add some lines like object level security, like; if(Schema.sObjectType.cg__SURL__c.isCreateable() && Schema.sObjectType.cg__SURL__c.isUpdateable()) Commented Dec 19, 2018 at 12:47
  • You wouldn’t need to as you are only looking for FLS the field level check should suffice! Commented Dec 19, 2018 at 12:48

1 Answer 1


Problem was related to curly brackets. In security review, it was expected to use curly brackets for each if-else statements; whether it has one line or multiple lines.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .