I've been using FFLIB_SecurityUtils lib to enforce CRUD and FLS in my apex classes. I've no issues when running unit tests, but when submitting my code on Source Scanner for partners, i've several security risks flag although CRUD and FLS are enforced as required
//..some code
fflib_SecurityUtils.checkInsert( //Throw an exception if CRUD/ FLS is not valid
customObject__c.SObjectType, // check sObject.isCreatable()
new List<Schema.SObjectField>{
customObject__c.Age, //check customObject__c.Age.isCreatable()
customObject__c.Address }); //check customObject__c.Address.isCreatable()
customObject__c cust = new customObject__c(
Age= 10,
Address = 'Paris, France'
);
insert cust;
SOURCE SCANNER SECURITY RISK FLAG
Do you think i should consider it as False positive and document it for the security review team or should i check any further?
Thank you