0

I need help in fixing below vulnerabilities found in CheckMarx scan.

Scenario:

I have written a trigger on FeedItem object.

This trigger will archive the FeedItem into custom object ArchivedFeedItem__c.

Whenever user posts chatter post, the post should be archived to a custom object.

This trigger will use handler class

FLS/CRUD permissions on ArchivedFeedItem__c: System Administrator only have access. No other user have FLS/CRUD permissions on this custom object.

So the handler class to be executed in system mode and without enforcing FLS/CRUD

Custom Object ArchivedFeedItem__c.object file ArchivedFeedItem__c.object

Trigger code:

trigger FeedItemCM on FeedItem (after insert) {
FeedItemHandlerCM.upsertArchivedFeedItem(trigger.new);

}

Handler Class Code:

public class FeedItemHandlerCM {
public static void upsertArchivedFeedItem(List<FeedItem> fiList) {
    List<ArchivedFeedItem__c> li = new List<ArchivedFeedItem__c>();
    ArchivedFeedItem__c tmp;
        for (FeedItem f : fiList){
            tmp = new ArchivedFeedItem__c();                 
            if(f.BestCommentId!=null) {
                tmp.BestCommentId__c            = f.BestCommentId;
            }
            if(f.Body!=null) {
                tmp.Body__c                     = f.Body;
            }
            tmp.CommentCount__c             = f.CommentCount;
            tmp.Created_By__c               = f.CreatedById;
            tmp.CreatedDate__c              = f.CreatedDate;
            tmp.FeedItemId__c               = f.Id;
            tmp.FullArchivedCommentList__c  = (f.CommentCount == 0);
            tmp.HasContent__c               = f.HasContent;
            tmp.HasFeedEntity__c            = f.HasFeedEntity;
            tmp.HasLink__c                  = f.HasLink;
            tmp.HasVerifiedComment__c       = f.HasVerifiedComment;
            tmp.Inserted_By__c              = (f.InsertedById != null) ? f.InsertedById : f.CreatedById ;
            tmp.isDeleted__c                = f.IsDeleted;
            tmp.IsRichText__c               = f.IsRichText;
            tmp.LastEditBy__c             = f.LastEditById;
            tmp.LastEditDate__c             = f.LastEditDate;
            tmp.LikeCount__c                = f.LikeCount;
            if(f.LinkUrl!=null) {
                tmp.LinkUrl__c                  = f.LinkUrl;
            }
            tmp.ParentId__c                 = f.ParentId;
            if(f.RelatedRecordId!=null) {
                tmp.RelatedRecordId__c          = f.RelatedRecordId;
            }
            tmp.Revision__c                 = f.Revision;
            tmp.Status__c                   = f.Status;
            tmp.Title__c                    = f.Title;
            tmp.Type__c                     = f.Type;
            li.add(tmp);
        }

        if (!li.isEmpty()){
            upsert li;
        }  


}

}

CheckMarx Report Summary

Vulnerability Type-------------Occurrences------------------Severity

PAA APEX FLS Create------------24---------------------------High

PAA APEX FLS Update------------24---------------------------High

PAA APEX FLS Create Partial----1----------------------------High

PAA APEX FLS Update Partial----1----------------------------High

Total issues 50: one for each field and type of operation(insert/update)

One Sample Issue details taken from CheckMarx Scan Report(All other 49 issues are similar)


Issue Details Start in Report

PAA APEX FLS Create\Path 1:

Severity: High

Result State: To Verify

Source File: V1/src/classes/FeedItemHandlerCM.cls

Destination File: V1/src/classes/FeedItemHandlerCM.cls

Line 9 44

Object bestcommentid__c li

Code Snippet

File Name V1/src/classes/FeedItemHandlerCM.cls

Method public static void upsertArchivedFeedItem(List fiList) {

....
  1. tmp.BestCommentId__c = f.BestCommentId;

.... 44. upsert li;

Issue Details End in report


If I enfore FLS/CRUD using stripInaccessible,

SObjectAccessDecision securityDecision = Security.stripInaccessible(AccessType.UPSERTABLE, li);
upsert securityDecision.getRecords();

Users are unable to post a chatter post and they are receivig below error as they don't have FLS/CRUD permissions on custom object.

Apex trigger FeedItemCM caused an unexpecte exception, contact your administrator: FeedItemCM: execution of AfterInsert System.NoAccessException: No access to entity Class.System.Security.stripInaccessible: line 15, column 1

Is this handler class or DML upsert really vulnerable?

How to fix the checkmarx issue without giving FLS/CRUD permissions to all profiles?

Is it false positive? If it is, then how can you say?

Appreciate your help. .

  • 1
    Since the goal of the requirement requires the code to operate against objects and fields that the contextual user may not have access to, you are forced to ignore CRUD/FLS in order to realize the requirement. As such this is a Checkmarx false positive and must be addressed by explaining the scenario in your submission documentation and, as per the linked Q/A, it is best to comment the code accordingly. – Phil W May 15 at 7:23
  • Thank you very much Phil for quick help on this. Your two responses helped very much! Appeciate your help. – Anil Kumar May 15 at 15:08
0

Since the goal of the requirement requires the code to operate against objects and fields that the contextual user may not have access to, you are forced to ignore CRUD/FLS in order to realize the requirement. As such this is a Checkmarx false positive and must be addressed by explaining the scenario in your submission documentation.

This answer covers how you can also best to comment the relevant code to help the Salesforce Security Team navigate the report from Checkmarx.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.