So I have this code:
obj.field1__c = 'placeholder';
if(MyCustomObject__c.sObjectType.getDescribe().isCreateable()){
insert obj;
}
When I receive the (Checkmarx Source Scanner report), I still get FLS Create errors for every field of the object I'm trying to insert:
Object: field1__c ... in file: classes/MyClass.cls
Object: obj in file: classes/MyClass.cls
L 49: insert obj;
FLS Create description:
This query looks for sObject Create operations that are performed without checking for isCreatable(). This may be a false positive if your code accesses only objects whose security is managed by your app and not the admin (for example OAuth states). It may also be a false positive if checks are performed outside of the dataflow (automatically in a visualforce inputfield tag or manually in a constructor), or if this is an enterprise object or other object whose permissions are not set by the admin.
So I'm just wondering why it still marks this as a Security Risk if I put the check in my actual code.
Is it a false positive? Should it be ignored? Can I make it disappear?
Note: actual objects & fields have different names, I've renamed them to not disclose any information.
Edit - Suggested Solution:
SObjectAccessDecision securityDecision = Security.stripInaccessible(AccessType.CREATABLE, new List<MyCustomObject__c>{objc});
if(!securityDecision.getRecords().isEmpty()){
insert securityDecision.getRecords()[0];
}