4

I've been using FFLIB_SecurityUtils lib to enforce CRUD and FLS in my apex classes. I've no issues when running unit tests, but when submitting my code on Source Scanner for partners, i've several security risks flag although CRUD and FLS are enforced as required

//..some code

fflib_SecurityUtils.checkInsert(    //Throw an exception if CRUD/ FLS is not valid
                customObject__c.SObjectType,   // check sObject.isCreatable()
                new List<Schema.SObjectField>{
                        customObject__c.Age, //check customObject__c.Age.isCreatable()
                        customObject__c.Address }); //check customObject__c.Address.isCreatable()

customObject__c cust = new customObject__c(

                Age= 10,
                Address = 'Paris, France'
);

            insert cust;

SOURCE SCANNER SECURITY RISK FLAG

SOURCE SCANNER SECURITY RISK FLAG

Do you think i should consider it as False positive and document it for the security review team or should i check any further?

Thank you

  • 4
    From what you posted, looks like a false positive - so I would document it in review As much as anything, the team is looking for you to show awareness of implementing security on the platform, so if you can show you are not exposing data etc, they should be ok with it – BritishBoyinDC May 27 at 14:51
  • Ok thanks @BritishBoyinDC – Bryce May 27 at 15:01
  • @BritishBoyinDC you may wany to add your comment as an answer. :) – Raul May 27 at 18:58
6

To help others who end up here, my response as an answer:

From what you posted, looks like a false positive - so I would document it in review.

Here is a link to a recent update from the SR team about how to document your false positives

As much as anything, the team is looking for you to show awareness of implementing security on the platform, so if you can show you are not exposing data etc, they should be ok with it

e.g.

FLS Create result path 1: Object: status__c in file: /classes/MyRequestData.cls

Response: This is checked via a general security/permissions check at start of class using fflib_SecurityUtils.checkInsert

If no access, permission check will throw exception, and code will no longer execute

  • Out of curiosity, how do you document this in a way that salesforce actually accept? – Nick Cook May 28 at 7:07
  • 1
    Edited with example - I always just keep it simple and seems to work ok – BritishBoyinDC May 28 at 10:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.