My code on scanner report gives some FLS Create errors code like this

public static cg__SURL__c upsertPublicLink(cg__SURL__c sUrl){

    if (String.isEmpty(sURL.cg__SUrl_Id__c)) {
        String baseURL = (String) SDriveConfigUtil.getSdriveConfigValue('BaseURL');
        if( !baseURL.endsWith('/') )
            baseURL += '/';
        //AS: isCreateable & isUpdateable() are added.
        if (Schema.sObjectType.cg__SURL__c.fields.cg__SUrl_Id__c.isCreateable() &&  Schema.sObjectType.cg__SURL__c.fields.cg__SUrl_Id__c.isUpdateable())
            sURL.cg__SUrl_Id__c = sUrlController.createKeyForSUrl();
        if (Schema.sObjectType.cg__SURL__c.fields.cg__Short_URL__c.isCreateable() &&  Schema.sObjectType.cg__SURL__c.fields.cg__Short_URL__c.isUpdateable())
            sURL.cg__Short_URL__c = baseURL + sURL.cg__SUrl_Id__c;


    upsert sUrl;
    return sUrl;

They show those type of errors on the report;

Object: cg__surl_id__c in file: classes/sUrlController.cls
L 384: sURL.cg__SUrl_Id__c = sUrlController.createKeyForSUrl();
Object: surl in file: classes/sUrlController.cls
L 390: upsert sUrl;

Object: cg__short_url__c in file: classes/sUrlController.cls
L 386: sURL.cg__Short_URL__c = baseURL + sURL.cg__SUrl_Id__c;
Object: surl in file: classes/sUrlController.cls
L 390: upsert sUrl;

I don't understand what I did wrong, I believe if clauses for both Line 384 and 386 are true. Should I add or delete or even change something in this piece of code?

  • 1
    It might be just a false positive – codeyinthecloud Dec 18 '18 at 20:37
  • As a newbie, how can I be sure that it is false positive. It seems hard to follow which of them accepted which of them are not (there are 80 fls create issues on the report). So, I can't be sure whether it is false positive or it does not fit to FLS create rules. – Bernard Black the Second Dec 18 '18 at 20:41
  • 2
    AFAIK as long as you're looking for the access checks like Schema.sObjectType.cg__SURL__c.fields.cg__SUrl_Id__c.isUpdateable(), I guess you should be fine! – codeyinthecloud Dec 18 '18 at 20:44
  • @codeyinthecloud Should I add some lines like object level security, like; if(Schema.sObjectType.cg__SURL__c.isCreateable() && Schema.sObjectType.cg__SURL__c.isUpdateable()) – Bernard Black the Second Dec 19 '18 at 12:47
  • You wouldn’t need to as you are only looking for FLS the field level check should suffice! – codeyinthecloud Dec 19 '18 at 12:48

Problem was related to curly brackets. In security review, it was expected to use curly brackets for each if-else statements; whether it has one line or multiple lines.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.