1

I want to find the best way to address false positives in the Checkmarx report. One of the points I am investigating is how to make the Checkmarx report to display the false positive comment that has been introduced in the Apex code.

  1. One of the ways I found it to be done is by putting the comment above the critical code line, i.e:
public Contact foo(String status, String ID) {
    // False-Positive: Done without SECURITY_ENFORCED because ...
    Contact c = [SELECT Status__c FROM Contact WHERE Id=:ID];
}
  1. After that, I thought that putting it as the method header could be cleaner, as we also have PMD Suppressions for the same and we could group more false positives. However, I'm not sure the latest FP would be transferred to the Checkmarx report.
// False-Positive: Done without SECURITY_ENFORCED because ...
@SuppressWarnings('PMD.ApexCRUDViolation')
public Contact foo(String status, String ID) {
    Contact c = [SELECT Status__c FROM Contact WHERE Id=:ID];
}

Are there any other better and/or more recommended ways to make Checkmarx use those comments?


Update 22-Feb-2023: There is one great way to do this provided in this answer.

1

0

You must log in to answer this question.

Browse other questions tagged .