"inputText_Ignoring_FLS" in force security scanner report

Question

I scan my code, and I received a Serious issue:

<apex:inputText value="{!ld.Name}" />

I have applied FLS as the guide here : http://wiki.developerforce.com/page/Enforcing_CRUD_and_FLS

<apex:inputText value="{!ld.Name}"  rendered="{!$ObjectType.Lead.fields.Name.Updateable}"/>

but it did not work.

Answer 1

Using apex:inputText and apex:inputTextArea does not enforce FLS automatically.

Please note that using other input tags such as apex:inputText or apex:inputTextArea with SObject fields indicate to VisualForce that the fields should not be treated as SObject fields and prevent the platform to automatically enforcing FLS.

Is there a reason you would not want to use apex:inputfield? This would automatically enforce FLS

When rendering VisualForce pages, the platform will automatically enforce CRUD and FLS when the developer references SObjects and SObject fields directly in the VisualForce page.