Questions tagged [checkmarx]
The checkmarx tag has no usage guidance.
59
questions
0
votes
1
answer
500
views
Lightning DOM XSS Injection Issue Reported in Checkmarx
After execution of checkmarx report we are facing injection issue for one of our aura lightning component
Issue reported :
The application's <aura:component
implements="force:appHostable,...
0
votes
1
answer
91
views
FLS Create Security Risk still appears even though object is checked if it is creatable
So I have this code:
obj.field1__c = 'placeholder';
if(MyCustomObject__c.sObjectType.getDescribe().isCreateable()){
insert obj;
}
When I receive the (Checkmarx Source Scanner report), I still get ...
1
vote
1
answer
100
views
Checkmarx - Bulkify Apex Methods Using Collections In Methods
Recently I ran a checkmarx scan and saw this issue
Query: Bulkify Apex Methods Using Collections In Methods
I don't understand why checkmarx is showing this issue in few places and not in all methods....
- 193
0
votes
1
answer
185
views
Checkmarx scanner says A3-Cross-Site Scripting (XSS)
I have a checkmarx issue in below VF page code as A3-Cross-Site Scripting (XSS) onclick
<apex:facet name="header">
<input type="checkbox" value="{!C....
- 197
1
vote
0
answers
73
views
Not able to fix checkmarx scanner issue
I am trying to fix checkmarx scanner issue in different ways but nothing helps to fix FLS Update and Crete.
Below are the things I tried
if(Schema.sObjectType.ProviderRecordQuestion__c.fields....
- 335
0
votes
2
answers
404
views
Second order SOQl/SOSL injection error during checkmarx scan
I am getting SOQL injection at line originalObjectQuery += ' WHERE Id = '' + originalId + '''; How can i reslove this?
public static Id close(Id originalId) {
//** Build query to return the full ...
- 49
0
votes
1
answer
1k
views
How should we fix Client potential XSS for InnerText and InnerHTML
I am using below code in component to get the values in JS controller and the functionality is working fine, but in Checkmarx scan it's coming as a potential XSS issue and I am not able to fix these ...
1
vote
1
answer
74
views
Query: Password APIs Issue on Salesforce Security Report
We have a scenario to allow the user to reset the password for the community users, We have used the following snippet
System.resetPassword(userId, true);
So its blocked in the security report under ...
6
votes
1
answer
213
views
Package review fails with new undocumented issues
My Managed package (yearly) Security Review failed with new issues I was not aware of and which I could not find documented anywhere, E.g.:
Stored XSS - "Avoid using escape=false unless ...
- 34.6k
3
votes
1
answer
644
views
How to run Source Code Scanner / Checkmarx against a Scratch Org?
Is it possible to run Source Code Scanner / Checkmarx against a Scratch Org?
When I click the Login link on this page:
https://security.secure.force.com/sourcescanner/
It redirects me to:
https://...
- 8,262
0
votes
0
answers
29
views
CheckMarx FLS Security Issue
I have applied updatable check still checkmarx report showing issues,Any idea..
Code:
Account Ac=new Account();
Ac.level_of_care__c='hhs';
if(Schema.sobjecttype.Account.isUpdateable() && ...
- 48
1
vote
1
answer
251
views
Checkmarx Security Scanner FLS Issues
I run the checkmarx scanner for app and received ~250 FLS issues, which is understood, because when the app developed it simply was not checked.
However I have noticed that there are lots of cases ...
- 1,545
0
votes
0
answers
319
views
Getting checkmarx FLS_Create Error in apex
Checkmarx is giving me the FLS_Create error in the below code.
cv.PathOnClient = docName;
cv.VersionData = requestbody;
cv.ContentLocation = 'S';
cv....
- 3
0
votes
0
answers
56
views
SOQL Injection error in the Checkmarx scanner report [duplicate]
I am facing below error:
In the below Scenario, I have tested it properly but still in order to avoid the SOQL injection, But when I am running the Checkmarx I am getting error as below:
public ...
- 1
0
votes
1
answer
699
views
Checkmarx FLS Update validation
I have a code where Checkmarx gives me this notification
FLS Update
Method processRequest of abc.cls gets user input from element error_message__c. This input is later concatenated by the application ...
- 197
0
votes
1
answer
94
views
checkmarx exception for dynamic DML, Ex: insert operation on input from method param
I am getting error as "SampleClass.cls Method sampleMethod at line 3 of classes\SampleClass.cls gets user input from the strVar element. This element’s value then flows through the code without being ...
0
votes
1
answer
572
views
Fix checkmarx report issue Client DOM XSRF
In vfComponent parent.location = self.location; and in checkmarx report it is showing
"component gets a parameter from a user request URL from element
location. This parameter value flows ...
- 1,298
0
votes
0
answers
573
views
Checkmarx report getting Recurring false postives
Salesforce complete org i have checked the details like security and Quality in this Checkmarx Report documentation showing Recurring false postives, if it is possible to remove recurring false ...
- 1,298
1
vote
1
answer
748
views
Checkmarx XSS Vulnerability with Lightning.CreateComponent
I have a visualforce page which creates a lightning component with the with the attributes provided something like this
`
<apex:page cache="false" showHeader="false" sidebar="false" ...
1
vote
1
answer
1k
views
Checkmarx Reflected XSS with getParameter
I have a visualforce page, which can have a parameter caseId.
For example :
https://myInstance/apex/myApp?caseId=500c000000DFyxW
The VF page creates a lightning component, but needs to pass case Id ...
- 555
1
vote
0
answers
1k
views
The CheckMarx security scanner gives error on Client Potential XSS vulnerability [closed]
In the code scanning, I am facing the Client Potential XSS issue.
Scan Result:
Can anyone please provide me any solution on this?
Thanks,
Ragav
- 65
1
vote
1
answer
594
views
Checkmarx Code Quality Warning
After running a Checkmarx scan it returned a code quality warning on a method due to Query: Bulkify Apex Methods Using Collections In Methods.
The method is very simple:
@AuraEnabled
public ...
- 1,387
0
votes
2
answers
1k
views
Checkmarx Scanner is useless for CRUD and FLS issues checking?
Checkmarx report field Id (User Object) as FLS Create violation whenever the code checks for OwnerId (Account Object) field is createable. Is it false-positive result or can I enforce FLS somehow to ...
- 645
0
votes
1
answer
312
views
RichText area field not eliminating XSS issue in checkmarx
I am writing escape=false in my VF Page like this.
<apex:outputText escape="false" value="{!cr.Message__c}" rendered="{!(cr.Message__c)!= ''}"/><br/><br/>
The Mesage__c is a custom ...
- 33
1
vote
1
answer
442
views
check FLS and CRUD for more than one field
I have a code which inserts custom Note__c object by using 5 fields. I want to check FLS and CRUD permission field level wise as they are reported in the checkmarx report.
I know we can write in if ...
- 33
6
votes
2
answers
3k
views
Checkmarx Force.com Security Source Scanner - any way to mark known false-positives?
For the Force.com Security Source Scanner, is there a mechanism of the same nature as eslint-disable-line for inhibiting known false-positive reports? With the false positives excluded, future scans ...
- 130k
-1
votes
2
answers
1k
views
Query: SOQL SOSL Injection in Security Review
While passing the app, I am still getting SOQL Injection errors in checkmarx.
Please advise why this is:
L 435: query += fmw.LeadFieldName + ', ';
L 437: query = query.substring(0 , query.length()-2)...
1
vote
1
answer
511
views
Salesforce security review - ID field fls create
In salesforce security review am getting a error FLS create which is for ID field. so when a FLS create error occurred, validated the isCreateable or isUpdatebale for update condtion.
Here how to ...
- 541
0
votes
1
answer
351
views
Code Scanner Report Query: XSRF Apex Serious Security Risk [duplicate]
I ran CheckMarx security code scanner and found this 1 security risk issue for a Button on Opportunity that opens a VF page (generates pdf).
From the code report, here is the issue mentioned. Can ...
- 3,964
0
votes
1
answer
365
views
Salesforce Checkmarx Integration
We need to setup the CheckMarx code scanner eclipse plug-in for Salesforce org.
While scanning from eclipse we are getting the server connection error massage :
1. We have downloaded the CxSAST ...
1
vote
1
answer
142
views
Error from security review
if(dupObjDel !=null && dupObjDel.size() > 0 ) {
if(isSafeObjectDel( dupObjDel ) ) {
delete dupObjDel; // ERROR in this line
}
}
public ...
- 11
2
votes
0
answers
696
views
checkmarx scan Dereferenced Field issue
I submitted code in checkmarx and in the result i got error as "Dereferenced Field" on following lines :
source as :
....
61. else return new
PageReference('/'+Vendor_Invoice_Line__c.sobjecttype....
- 557
1
vote
0
answers
264
views
DML on page action
I have the following situation in my plate ...
On page load, a modal pops up.
The modal is invoked on an action attribute in apex:page.
The method that is on the action has an upsert operation that ...
- 3,102
1
vote
1
answer
451
views
checkmarx scanner results for custom settings
I get a lot of CRUD/FLS security risks on the checkmarx scanner results while scanning our managed package.
Does one need CRUD/FLS checks on public custom settings or can they be considered as false ...
- 235
2
votes
0
answers
442
views
The CheckMarx security scanner gives error on Stored XSS vulnerability
I have a javaScript method in my visualforce page, which is adding a css when page loads.
Code adds the css to radio buttons to look similar to Lightning radio buttons.
var Row = document....
- 21
2
votes
1
answer
284
views
Bulkify Apex Methods Using Collections In Methods false positive?
Why would a simple method like
@RemoteAction
global static Custom__c upsertCustom(Custom__c custom){
upsert custom;
return [SELECT Id, Name, CalculatedField__c FROM Custom__c WHERE Id = :...
- 2,022
4
votes
1
answer
204
views
Unable to simulate FLS/CRUD security leaks although no checks in code
I recently checked my managed package using the Force.com Security chechker (by Checkmarx) and the tool listed a few CRUD and FLS issues in my Controller classes.
Before fixing them I tried to better ...
- 34.6k
5
votes
1
answer
2k
views
Why Is Checkmarx Taking So Long To Complete? [closed]
Recently submitted an app to the Force.com source code scanner by CheckMarx, after 5 days still there is no sign of scanning report. It will be helpful if that tool tells some approx waiting period. ...
- 6,634
2
votes
1
answer
1k
views
Prevent CRUD Delete/Insert/Update Checkmarx Issue for SObject in Apex Code
I am using Database methods for DML on SObjects. I am getting CRUD Delete issue in CheckMarx security scanner for below line:
public SObject toDML;
Database.delete(toDML, false);
Can anyone help ...
2
votes
2
answers
1k
views
The CheckMarx security scanner says that these lines is a Query: XSRF Error
I have a visualforce which is just used to send the Json data when we make a callout to the page with some parameters passed in the URL.
Error is showing in the following line. Please help in get ...
- 367
0
votes
1
answer
1k
views
The CheckMarx security scanner says that these lines is a Stored XSS
Do not know why checkmarx throwing these errors. As there is nothing that needs to be HTMLENCODE. Although VF page showing the data that is being added from Line 344 and 345 from a <apex:...
- 367
3
votes
1
answer
1k
views
"Client Cross Frame Scripting Attack" by Checkmarx Scanner for Visualforce component
I have got the Client Cross Frame Scripting Attack alert in the recent CheckMarx scanner. However, it points to an auto generated ID.
I've seen the following links however, the I'm not sure about ...
- 1,574
0
votes
1
answer
573
views
Client Cross Frame Scripting Attack by Checkmarx scanner for visualforce component, [duplicate]
I am Using visualforce component for insert and updating child record. this component is reusable for multiple objects, like account, contact, etc., as like we can use this. I am doing DML inside a ...
4
votes
2
answers
2k
views
XSS : Rich textarea content security review issue when using escape=false
I am getting user input through textarea as richtext and storing in object :
<div class="col-md-12">
<div class="col-md-12">
<div class="form-group">
<...
- 398
1
vote
1
answer
323
views
How to resolve Bulkify apex methods using collections in methods (Chckmarx issue)? [closed]
I have submitted my code for security review and got a few warnings for the Bulkify Apex Methods Using Collections In Methods.
I have read the code best practices and also some stack exchange posts ...
- 1,574
2
votes
1
answer
121
views
Security Review Scanner help
I ran the checkmarx security scanner and I got 1 item flagged as a "Bulkify Apex Methods" but I'm not 100% sure I get what's the issue there.
Here's a screenshot of the Checkmarx issue.
Can you ...
- 866
0
votes
0
answers
4k
views
ISCLONE() and Workflow Rules against CLONED records
I am trying to create some business logic that resets a cloned Opportunity check-box field to FALSE if that Opportunity record is cloned (our sales team will clone opportunities with the same accounts ...
- 543
2
votes
2
answers
4k
views
How to resolve Cross Site Request Forgery(CSRF) in salesforce?
In the VF page controller I am receiving the data in a page load method using ApexPages.currentPage().getParameters() and inserting the data in to one of the custom object. Every thing works fine.
But ...
- 311
0
votes
1
answer
105
views
Checkmarx results for appExchange entries
Our company's internal Information Security folks are used to using Veracode to scan web & app code.
I understand appExchange entries are scanned via SFDC / Checkmarx.
My question is: Is there ...
2
votes
1
answer
917
views
Reflected XSS problem
Checkmarx is flagging these lines as Reflected XSS,Lately I have been doing a lot of research on this but couldn't solve this one can someone point me as to why these are major security threats?
...
user13277