Questions tagged [checkmarx]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
30 views

SOQl Injection Checkmarx issues

I am getting SOQL Injection checkmarx issue even after applying escapeSingleQuotes. Can you pls tell what should I apply to remove checkmarx issue. Here is Code public static Interaction__c ...
Shivanshu's user avatar
0 votes
1 answer
91 views

Salesforce package version creation after resolving the errors

We are planning to publish the package to the appexchange security review process before which we have run through a security scan. The package version is 0.1.0-1. After resolving the errors from the ...
Rahul Allada's user avatar
1 vote
0 answers
50 views

Checkmarx reporting wrong function name?

I just ran a Checkmarx scan today. It reported the following Apex Serious Security Risk: You can see the report is making a reference to isCreatable(). However, the name of the method in my Apex code ...
dev4life's user avatar
  • 362
1 vote
1 answer
119 views

Sending review to the checkmarx where multiple developments are included

I have a org that is connected to the partner community. In this org, there are managed packages, unmanaged packages, and various other developments that includes code that is not required for the ...
Rahul Allada's user avatar
2 votes
1 answer
277 views

Query: FLS Create issue while running checkmarx

I am running multiple classes and have some Query: FLS Create issues while running the checkmarx. I am really not knowing what they mean by this. I feel there is something simple but I cannot discern ...
Rahul Allada's user avatar
0 votes
0 answers
57 views

How to scan the Second Generation managed package code on Checkmarx Scanner from Partner Security Portal

I have created a second generation managed package using the dev hub org and namespace org and I have connected the dev hub org in the organizations subtab in publishing tab. But when I tried to login ...
S1th's user avatar
  • 3
1 vote
0 answers
253 views

Transport False-Positive comments to Checkmarx report

I want to find the best way to address false positives in the Checkmarx report. One of the points I am investigating is how to make the Checkmarx report to display the false positive comment that has ...
Manuel Moya's user avatar
0 votes
1 answer
794 views

Prototype Pollution vulnerability for location.search.substr(1)

I have a specific code for which I am getting Prototype Pollution vulnerability in checkmark. Here is the code ({ getJsonFromUrl: function(cmp,event,helper){ var query = location.search.substr(1); ...
user2991219's user avatar
4 votes
2 answers
879 views

Strange error is showing when trying to open partner security portal with primary partner community user

https://security.secure.force.com/sourcescanner/ is down for maintenance Sorry for the inconvenience. We'll be back shortly. Please email us if you need to get in touch. This error is shown when I ...
Patlatus's user avatar
  • 15.8k
0 votes
1 answer
106 views

Is fixing "Apex Code Quality" issues necessary for passing security review?

I have fixed all the "Apex Critical Security Risk" issues but there are few apex code quality issues remaining. Some of them are false positives and some are correct. But due to time ...
Manjot Singh's user avatar
  • 3,404
3 votes
1 answer
300 views

Resubmit for Security Review without Patches

I am working for an existing AppExchange ISV Partner that missed the deadlines for Security Review resubmission. When that happens Salesforce is not only taking your Listing down but also deactivating ...
Robert Sösemann's user avatar
6 votes
1 answer
280 views

Best (commercial) Scanner to stay prepared for Security Review

For ISVs to be safe to (re)submit their app for Security Review without issues Checkmarx still is the only authoritative tool. But it is also cumbersome and limited as: Community Scanner is limited ...
Robert Sösemann's user avatar
1 vote
0 answers
203 views

Run Checkmarx on code not in packaging org (too big for Community scanner)

I am consulting an ISV partner with their resubmission of the Salesforce Security Review. They ran the initial Checkmarx scan using the Partner Scanner on the code in their Packaging org, then fixed ...
Robert Sösemann's user avatar
0 votes
1 answer
3k views

Lightning DOM XSS Injection Issue Reported in Checkmarx

After execution of checkmarx report we are facing injection issue for one of our aura lightning component  Issue reported :  The application's <aura:component implements="force:appHostable,...
SalesforceEnthuDev10's user avatar
0 votes
1 answer
626 views

FLS Create Security Risk still appears even though object is checked if it is creatable

So I have this code: obj.field1__c = 'placeholder'; if(MyCustomObject__c.sObjectType.getDescribe().isCreateable()){ insert obj; } When I receive the (Checkmarx Source Scanner report), I still get ...
ionut.baltariu's user avatar
1 vote
1 answer
302 views

Checkmarx - Bulkify Apex Methods Using Collections In Methods

Recently I ran a checkmarx scan and saw this issue Query: Bulkify Apex Methods Using Collections In Methods I don't understand why checkmarx is showing this issue in few places and not in all methods....
user1228's user avatar
  • 303
0 votes
1 answer
660 views

Checkmarx scanner says A3-Cross-Site Scripting (XSS)

I have a checkmarx issue in below VF page code as A3-Cross-Site Scripting (XSS) onclick <apex:facet name="header"> <input type="checkbox" value="{!C....
user75937's user avatar
  • 299
1 vote
0 answers
248 views

Not able to fix checkmarx scanner issue

I am trying to fix checkmarx scanner issue in different ways but nothing helps to fix FLS Update and Crete. Below are the things I tried if(Schema.sObjectType.ProviderRecordQuestion__c.fields....
SFDC-Beginner's user avatar
0 votes
2 answers
1k views

Second order SOQl/SOSL injection error during checkmarx scan

I am getting SOQL injection at line originalObjectQuery += ' WHERE Id = '' + originalId + '''; How can i reslove this? public static Id close(Id originalId) { //** Build query to return the full ...
Shira's user avatar
  • 49
1 vote
1 answer
3k views

How should we fix Client potential XSS for InnerText and InnerHTML

I am using below code in component to get the values in JS controller and the functionality is working fine, but in Checkmarx scan it's coming as a potential XSS issue and I am not able to fix these ...
Reddy sri's user avatar
1 vote
1 answer
143 views

Query: Password APIs Issue on Salesforce Security Report

We have a scenario to allow the user to reset the password for the community users, We have used the following snippet System.resetPassword(userId, true); So its blocked in the security report under ...
Yaswanth Tikkisetti's user avatar
6 votes
1 answer
237 views

Package review fails with new undocumented issues

My Managed package (yearly) Security Review failed with new issues I was not aware of and which I could not find documented anywhere, E.g.: Stored XSS - "Avoid using escape=false unless ...
Robert Sösemann's user avatar
5 votes
1 answer
2k views

How to run Source Code Scanner / Checkmarx against a Scratch Org?

Is it possible to run Source Code Scanner / Checkmarx against a Scratch Org? When I click the Login link on this page: https://security.secure.force.com/sourcescanner/ It redirects me to: https://...
Robs's user avatar
  • 9,047
0 votes
0 answers
53 views

CheckMarx FLS Security Issue

I have applied updatable check still checkmarx report showing issues,Any idea.. Code: Account Ac=new Account(); Ac.level_of_care__c='hhs'; if(Schema.sobjecttype.Account.isUpdateable() && ...
Prachi's user avatar
  • 58
2 votes
1 answer
681 views

Checkmarx Security Scanner FLS Issues

I run the checkmarx scanner for app and received ~250 FLS issues, which is understood, because when the app developed it simply was not checked. However I have noticed that there are lots of cases ...
Liron C's user avatar
  • 1,764
0 votes
0 answers
777 views

Getting checkmarx FLS_Create Error in apex

Checkmarx is giving me the FLS_Create error in the below code. cv.PathOnClient = docName; cv.VersionData = requestbody; cv.ContentLocation = 'S'; cv....
Panda's user avatar
  • 3
0 votes
0 answers
58 views

SOQL Injection error in the Checkmarx scanner report [duplicate]

I am facing below error: In the below Scenario, I have tested it properly but still in order to avoid the SOQL injection, But when I am running the Checkmarx I am getting error as below: public ...
Raam's user avatar
  • 1
0 votes
1 answer
961 views

Checkmarx FLS Update validation

I have a code where Checkmarx gives me this notification FLS Update Method processRequest of abc.cls gets user input from element error_message__c. This input is later concatenated by the application ...
user75937's user avatar
  • 299
0 votes
1 answer
181 views

checkmarx exception for dynamic DML, Ex: insert operation on input from method param

I am getting error as "SampleClass.cls Method sampleMethod at line 3 of classes\SampleClass.cls gets user input from the strVar element. This element’s value then flows through the code without being ...
Ashok Kasthuri's user avatar
0 votes
1 answer
1k views

Fix checkmarx report issue Client DOM XSRF

In vfComponent parent.location = self.location; and in checkmarx report it is showing "component gets a parameter from a user request URL from element location. This parameter value flows ...
cloudZigZag's user avatar
  • 1,356
0 votes
0 answers
1k views

Checkmarx report getting Recurring false postives

Salesforce complete org i have checked the details like security and Quality in this Checkmarx Report documentation showing Recurring false postives, if it is possible to remove recurring false ...
cloudZigZag's user avatar
  • 1,356
1 vote
1 answer
1k views

Checkmarx XSS Vulnerability with Lightning.CreateComponent

I have a visualforce page which creates a lightning component with the with the attributes provided something like this ` <apex:page cache="false" showHeader="false" sidebar="false" ...
Vinod Chokkula's user avatar
1 vote
1 answer
2k views

Checkmarx Reflected XSS with getParameter

I have a visualforce page, which can have a parameter caseId. For example : https://myInstance/apex/myApp?caseId=500c000000DFyxW The VF page creates a lightning component, but needs to pass case Id ...
user2957592's user avatar
1 vote
0 answers
2k views

The CheckMarx security scanner gives error on Client Potential XSS vulnerability [closed]

In the code scanning, I am facing the Client Potential XSS issue. Scan Result: Can anyone please provide me any solution on this? Thanks, Ragav
Ragavendra's user avatar
1 vote
1 answer
824 views

Checkmarx Code Quality Warning

After running a Checkmarx scan it returned a code quality warning on a method due to Query: Bulkify Apex Methods Using Collections In Methods. The method is very simple: @AuraEnabled public ...
Zack Walton's user avatar
  • 1,521
1 vote
2 answers
1k views

Checkmarx Scanner is useless for CRUD and FLS issues checking?

Checkmarx report field Id (User Object) as FLS Create violation whenever the code checks for OwnerId (Account Object) field is createable. Is it false-positive result or can I enforce FLS somehow to ...
Grzegorz Połuch's user avatar
0 votes
1 answer
405 views

RichText area field not eliminating XSS issue in checkmarx

I am writing escape=false in my VF Page like this. <apex:outputText escape="false" value="{!cr.Message__c}" rendered="{!(cr.Message__c)!= ''}"/><br/><br/> The Mesage__c is a custom ...
AJoshi's user avatar
  • 33
1 vote
1 answer
663 views

check FLS and CRUD for more than one field

I have a code which inserts custom Note__c object by using 5 fields. I want to check FLS and CRUD permission field level wise as they are reported in the checkmarx report. I know we can write in if ...
AJoshi's user avatar
  • 33
7 votes
2 answers
3k views

Checkmarx Force.com Security Source Scanner - any way to mark known false-positives?

For the Force.com Security Source Scanner, is there a mechanism of the same nature as eslint-disable-line for inhibiting known false-positive reports? With the false positives excluded, future scans ...
Keith C's user avatar
  • 134k
-1 votes
2 answers
2k views

Query: SOQL SOSL Injection in Security Review

While passing the app, I am still getting SOQL Injection errors in checkmarx. Please advise why this is: L 435: query += fmw.LeadFieldName + ', '; L 437: query = query.substring(0 , query.length()-2)...
Salesforce Things's user avatar
1 vote
1 answer
581 views

Salesforce security review - ID field fls create

In salesforce security review am getting a error FLS create which is for ID field. so when a FLS create error occurred, validated the isCreateable or isUpdatebale for update condtion. Here how to ...
SFDC's user avatar
  • 461
0 votes
1 answer
437 views

Code Scanner Report Query: XSRF Apex Serious Security Risk [duplicate]

I ran CheckMarx security code scanner and found this 1 security risk issue for a Button on Opportunity that opens a VF page (generates pdf). From the code report, here is the issue mentioned. Can ...
sfdcFanBoy's user avatar
  • 4,035
0 votes
1 answer
432 views

Salesforce Checkmarx Integration

We need to setup the CheckMarx code scanner eclipse plug-in for Salesforce org. While scanning from eclipse we are getting the server connection error massage : 1. We have downloaded the CxSAST ...
Vishal Nayak's user avatar
1 vote
1 answer
185 views

Error from security review

if(dupObjDel !=null && dupObjDel.size() > 0 ) { if(isSafeObjectDel( dupObjDel ) ) { delete dupObjDel; // ERROR in this line } } public ...
user3598411's user avatar
2 votes
1 answer
995 views

checkmarx scan Dereferenced Field issue

I submitted code in checkmarx and in the result i got error as "Dereferenced Field" on following lines : source as : .... 61. else return new PageReference('/'+Vendor_Invoice_Line__c.sobjecttype....
patelkiran3090's user avatar
1 vote
0 answers
288 views

DML on page action

I have the following situation in my plate ... On page load, a modal pops up. The modal is invoked on an action attribute in apex:page. The method that is on the action has an upsert operation that ...
MnZ's user avatar
  • 3,152
1 vote
1 answer
510 views

checkmarx scanner results for custom settings

I get a lot of CRUD/FLS security risks on the checkmarx scanner results while scanning our managed package. Does one need CRUD/FLS checks on public custom settings or can they be considered as false ...
Tan's user avatar
  • 245
2 votes
0 answers
622 views

The CheckMarx security scanner gives error on Stored XSS vulnerability

I have a javaScript method in my visualforce page, which is adding a css when page loads. Code adds the css to radio buttons to look similar to Lightning radio buttons. var Row = document....
Sunil Raj's user avatar
2 votes
1 answer
341 views

Bulkify Apex Methods Using Collections In Methods false positive?

Why would a simple method like @RemoteAction global static Custom__c upsertCustom(Custom__c custom){ upsert custom; return [SELECT Id, Name, CalculatedField__c FROM Custom__c WHERE Id = :...
Jose's user avatar
  • 2,092
4 votes
1 answer
220 views

Unable to simulate FLS/CRUD security leaks although no checks in code

I recently checked my managed package using the Force.com Security chechker (by Checkmarx) and the tool listed a few CRUD and FLS issues in my Controller classes. Before fixing them I tried to better ...
Robert Sösemann's user avatar