0

So I have this code:

obj.field1__c = 'placeholder';
if(MyCustomObject__c.sObjectType.getDescribe().isCreateable()){
    insert obj;
}

When I receive the (Checkmarx Source Scanner report), I still get FLS Create errors for every field of the object I'm trying to insert:

Object: field1__c ... in file: classes/MyClass.cls
Object: obj in file: classes/MyClass.cls
L 49: insert obj;

FLS Create description:

This query looks for sObject Create operations that are performed without checking for isCreatable(). This may be a false positive if your code accesses only objects whose security is managed by your app and not the admin (for example OAuth states). It may also be a false positive if checks are performed outside of the dataflow (automatically in a visualforce inputfield tag or manually in a constructor), or if this is an enterprise object or other object whose permissions are not set by the admin.

So I'm just wondering why it still marks this as a Security Risk if I put the check in my actual code.

Is it a false positive? Should it be ignored? Can I make it disappear?

Note: actual objects & fields have different names, I've renamed them to not disclose any information.

Edit - Suggested Solution:

    SObjectAccessDecision securityDecision = Security.stripInaccessible(AccessType.CREATABLE, new List<MyCustomObject__c>{objc});

    if(!securityDecision.getRecords().isEmpty()){
        insert securityDecision.getRecords()[0];
    }

1 Answer 1

3

Fields and objects each have their own security. You are expected to check every object and field, e.g. MyCustomObject__c.field1__c.getDescribe().isCreateable(). You can simplify these checks with Security.stripInaccessible.

4
  • That is actually interesting. I have edited the question with a possible solution. I am wondering if this is the way in which the security decision should be used. (I only have a single object to push in that particular context). Jan 6, 2022 at 13:15
  • 1
    @ionut.baltariu yes, that is one acceptable solution for this warning.
    – sfdcfox
    Jan 6, 2022 at 13:26
  • just wondering, any ideas why this warning wouldn't show up for other custom objects? the scenarios are more or less the same, the only difference being that those objects are being inserted in bulk. Jan 6, 2022 at 13:34
  • @ionut.baltariu It depends on how the values are initialized. For example, values initialized from a VF page using apex:inputField are okay, because that element checks FLS for you.
    – sfdcfox
    Jan 6, 2022 at 14:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .