I have a code where Checkmarx gives me this notification

FLS Update

Method processRequest of abc.cls gets user input from element error_message__c. This input is later concatenated by the application directly into a string variable containing SQL commands, without being validated. This string is then used in method processRequest to query the database lstInputsize of abc.cls, without any additional filtering by the database. This could allow the user to tamper with the filter parameter

    Response = InbMessagePUtil.StIO(appId, tName, null, reqType);

     If (lstInputsize() > 0)

       lstInputsize[0].Status__c = 'Processed';

    } else {
        InbMessagePUtil.StIO(appId, tName, null, reqType);
        if (lstInputsize.size() > 0)
            lstInputsize[0].Status__c = 'Error';

       if (lstInputsize.size() > 0) {
        if (Response.length() > 120000)
            lstInputsize[0].Error_Message__c = Response.substring(0, 120000);
            lstInputsize[0].Error_Message__c = Response;
        update lstInputsize;

1 Answer 1


This posting does not actually pose a question and doesn't appear to include the relevant part of the code for the headline issue. You suggest it is a CRUD/FLS issue but the description suggests a SQL Coding Injection vulnerability instead or as well.

All of the various security vulnerabilities and the basic approaches for resolving them are covered well in the Salesforce documentation (you can start reading here). There's also lots of Trailhead material, such as the injection vulnerability prevention and data leak prevention stuff.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.