10

I've submitted my application for Security Review and I've got this problem in the report.
I'm not sure how to fix it.

Let's see the First case:
I have some classes that don't have any code like this one: 

public with sharing class MyClass{  
    public MyClass(){
    }
}

Why this class does not have any code?
At some time this class was included in a managed package, but later the class and it's code became deprecated and it was all cleared. But since the class is already on the package I didn't delete it.

Second case:

I have some classes that extends a Expection like this one: 

public with sharing class MyClassException extends Exception{
}

So. What can I do to fix the this problem and get my app submitted?

Improve this question
1
  • Out of interest, if you just shove in a rubbish method does that eliminate the warning? something like public String GetBubbles() { return 'Bub'; }
    – Matt Lacey ♦
    Commented Feb 4, 2013 at 23:43

2 Answers 2

Reset to default
4
  • You can delete your classes, so long as they are not public. This not always the case, so thus maybe why you didn't delete them before. But you can now.
  • Regarding the Exception class, obviously you have a need for this. I have to confess I've never seen the 'Incomplete code blocks vulnerability', nor can find a reference to it, unlike the others the SF Security team flag. Personally I would say it has a obvious case for a 'false positive' discussion with them, it's clearly a pattern the docs suggest. Though without the 'with sharing' perhaps? Could you maybe share more info you got from the SF security report on this in your answer?
Improve this answer
3
  • 1
    The tool is definitely susceptible to false positives and I can confirm that if you file a case and have a chat on the phone it's easy enough to get the go-ahead to submit.
    – Matt Lacey ♦
    Commented Feb 4, 2013 at 23:42
  • I didn't received any info about this. All I got was a list of classes with this vunerability
    – Ivo Rocha
    Commented Feb 5, 2013 at 10:00
  • That is strange, normally the report is very clear about the issue it is highlighting. Its hard to help further without this to be honest. Only thing I still recommend is to discuss with them to find out more.
    – Andrew Fawcett
    Commented Feb 6, 2013 at 10:08
4

What exactly is the error you are getting flagged with, and from which tool? I have several "empty" exception classes such as your second example and never saw those get flagged from the security scanner.

The first example should not be a problem either; if it is getting flagged by the code scanner it's clearly a false positive.

If you're really worried about it, book office hours with the security team or email them at [email protected] - they are very responsive.

Improve this answer
4
  • This was an problem sent on the report from the security review team. Via checkmarx I didn't get any issue, or any other tool.
    – Ivo Rocha
    Commented Feb 5, 2013 at 9:18
  • You mean they manually flagged it as a security issue? Did they explain what the vulnerability is?? I don't know why they would flag an empty class as a security issue. I'd suggest scheduling office hours to discuss with them, and please post here what the ultimate resolution is.
    – jkraybill
    Commented Feb 5, 2013 at 23:31
  • Yes. they manually flagged it as a security issue. I already talked with them about this, and they said "If this class is empty probably it will have code some day, and for now it does not have any purpose", then I explan that those classes are deprecated, except the Exceptions classes.
    – Ivo Rocha
    Commented Feb 6, 2013 at 18:06
  • That is really inane. If any security review people read this, please stop flagging empty classes as some sort of a security risk. They are not, and there are many legitimate use cases for empty classes. @Ivo - I'd suggest the easiest fix is to add some silly code to them, like String getName() { return 'classname'; }
    – jkraybill
    Commented Feb 7, 2013 at 4:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .