Checkmarx Security Scanner FLS Issues

Question

I run the checkmarx scanner for app and received ~250 FLS issues, which is understood, because when the app developed it simply was not checked.

However I have noticed that there are lots of cases that the code doesn't check the FLS but the scanner didn't report.

At first I thought it reach some limit number in the FLS section and therefore doesn't report everything, but after fixing most of the reported FLS, I run the scanner again and there are only few FLS left (custom setting that cannot be checked). Meaning, there are lots of places that are not being checked or reported.

Does someone know what are the conditions/cases that the scanner doesn't report FLS issue? Can I rely on this for the security review? Should I run scanner with other tools? Any suggestion for other tools?

**

• Update

** after scanning with the PMD tool, it reported some FLS that was not reported by checkmarx scanner, but still lots of cases was not reported or cases reported which should not been.

-It seems that PMD is not reporting FLS when using Database.update/insert/upsert. -Both PMD and checkmarx doesn't report FLS error when update map.values. e.g:

map<Id, Account> accountMap = new map<Id, Account>();

        for(Account acc  :accountList ){
            accountMap.put(acc.Id, acc);
        }
        update accountList.values();

-PMD does not identify FLS was checked if the check is being done in other function (checkmarx know to identify it and does not report it) e.g:

if(MySecurityEnforcer.isUserAllowed('update', accountList)){
            update accountList;
        }

Probably I could go on and check each case and identify why it was/not reported, but I realize that due to the complexity of the process such tools are not perfect. I decided to overview all the code myself and add the FLS before any dml action.

Answer 1

In our experience:

1. Checkmarx does actually have a limit (500 or there abouts) for any one of the types of security issue that it will find (we know this because we have 1000s of CRUD/FLS false positives).
2. Checkmarx cannot detect CRUD/FLS enforcement that is done earlier in a code flow but via a separate method call (hence our 1000s of false positives) but it does handle tests at higher levels in the code flow.
3. From feedback during previous security reviews, Checkmarx is exactly what the Salesforce Security Review team relies on to scan the code themselves (though I don't know if they have higher limits against each type of security issue when they run in).
4. Use of PMD with the Salesforce Apex security ruleset is a good approach to keeping on top of security issues during development without the need to upload a package version and use up Checkmarx execution limits.

Note that both Checkmarx and PMD suffer the same myopic scanning issue with the application of security checks in separate method calls.

I must say that we also augment the scans via the use of regex searches on the code base so we can exclude explicitly marked false positives (we provide comments in the code on the end of the first line of the statement that PMD or Checkmarx erroneously flag and in doing so we actually have it such that the Checkmarx report includes our false positive explanations themselves given the way it lifts the "faulty code" lines and puts them in the report).

We haven't spotted Checkmarx missing issues (probably due to our false positives count!) so can't help explain that.