Questions tagged [checkmarx]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
9
votes
2answers
6k views

How Checkmarx works

Can someone please advise how Checkmarx/ Force.com Security Source Scanner will be performing code review Is code review happening within Salesforce servers or code get ported to Checkmarx server How ...
8
votes
2answers
971 views

Checkmarx and JSON.serialize

My Salesforce1 code has been recently run through Force.com Security Scanner (a.k.a. Checkmarx). A stored XSS vulnerability has been found and marked as critical security risk. It boils down to ...
6
votes
2answers
669 views

Checkmarx Force.com Security Source Scanner - any way to mark known false-positives?

For the Force.com Security Source Scanner, is there a mechanism of the same nature as eslint-disable-line for inhibiting known false-positive reports? With the false positives excluded, future scans ...
5
votes
1answer
553 views

Why Is Checkmarx Taking So Long To Complete? [closed]

Recently submitted an app to the Force.com source code scanner by CheckMarx, after 5 days still there is no sign of scanning report. It will be helpful if that tool tells some approx waiting period. ...
4
votes
2answers
773 views

XSS : Rich textarea content security review issue when using escape=false

I am getting user input through textarea as richtext and storing in object : <div class="col-md-12"> <div class="col-md-12"> <div class="form-group"> <...
4
votes
0answers
113 views

Unable to simulate FLS/CRUD security leaks although no checks in code

I recently checked my managed package using the Force.com Security chechker (by Checkmarx) and the tool listed a few CRUD and FLS issues in my Controller classes. Before fixing them I tried to better ...
3
votes
1answer
872 views

“Client Cross Frame Scripting Attack” by Checkmarx Scanner for Visualforce component

I have got the Client Cross Frame Scripting Attack alert in the recent CheckMarx scanner. However, it points to an auto generated ID. I've seen the following links however, the I'm not sure about ...
3
votes
2answers
1k views

How do I fix this Stored XSS?

The CheckMarx security scanner says that this line is a Stored XSS vulnerability <apex:column style="background-color:#{!trade.bgcolor};color:{!trade.fgcolor};"> is this HTMLENCODE the correct ...
3
votes
1answer
695 views

Chckmarx issue : How to resolve Bulkify apex methods using collections in methods?

I am working on an app which we plan to publish on app exchange. As per pre-requisite requirement by salesforce, any app before getting listed on app exchange should go through code review from ...
2
votes
2answers
448 views

The CheckMarx security scanner says that these lines is a Query: XSRF Error

I have a visualforce which is just used to send the Json data when we make a callout to the page with some parameters passed in the URL. Error is showing in the following line. Please help in get ...
2
votes
1answer
105 views

Bulkify Apex Methods Using Collections In Methods false positive?

Why would a simple method like @RemoteAction global static Custom__c upsertCustom(Custom__c custom){ upsert custom; return [SELECT Id, Name, CalculatedField__c FROM Custom__c WHERE Id = :...
2
votes
1answer
193 views

Salesforce Security Review for composite app

I have developed a managed package which is using public API's for providing functionality. I have gone through CheckMarx source code scanner and got report as "you do not have any security issues". I ...
2
votes
1answer
496 views

Reflected XSS problem

Checkmarx is flagging these lines as Reflected XSS,Lately I have been doing a lot of research on this but couldn't solve this one can someone point me as to why these are major security threats? ...
2
votes
0answers
162 views

The CheckMarx security scanner gives error on Stored XSS vulnerability

I have a javaScript method in my visualforce page, which is adding a css when page loads. Code adds the css to radio buttons to look similar to Lightning radio buttons. var Row = document....
2
votes
1answer
96 views

Security Review Scanner help

I ran the checkmarx security scanner and I got 1 item flagged as a "Bulkify Apex Methods" but I'm not 100% sure I get what's the issue there. Here's a screenshot of the Checkmarx issue. Can you ...
1
vote
2answers
1k views

How do I fix this Stored XSS vulnerability?

The CheckMarx security scanner says that the 4th line: $j('#h{!category}').on('click', function(event) { in the following script, causes an XSS vulnerability. Can someone explain the best way to ...
1
vote
1answer
254 views

Checkmarx Code Quality Warning

After running a Checkmarx scan it returned a code quality warning on a method due to Query: Bulkify Apex Methods Using Collections In Methods. The method is very simple: @AuraEnabled public ...
1
vote
1answer
463 views

Prevent CRUD Delete/Insert/Update Checkmarx Issue for SObject in Apex Code

I am using Database methods for DML on SObjects. I am getting CRUD Delete issue in CheckMarx security scanner for below line: public SObject toDML; Database.delete(toDML, false); Can anyone help ...
1
vote
1answer
45 views

Checkmarx Reflected XSS with getParameter

I have a visualforce page, which can have a parameter caseId. For example : https://myInstance/apex/myApp?caseId=500c000000DFyxW The VF page creates a lightning component, but needs to pass case Id ...
1
vote
2answers
3k views

How do I fix this Reflected XSS vulnerability?

The CheckMarx security scanner says that this line is a Reflected XSS vulnerability. <apex:outputText value="0,number,#,##0.00}" style="color:!nost.balColor};"> However this page http://www....
1
vote
2answers
1k views

How to resolve Cross Site Request Forgery(CSRF) in salesforce?

In the VF page controller I am receiving the data in a page load method using ApexPages.currentPage().getParameters() and inserting the data in to one of the custom object. Every thing works fine. But ...
1
vote
1answer
102 views

check FLS and CRUD for more than one field

I have a code which inserts custom Note__c object by using 5 fields. I want to check FLS and CRUD permission field level wise as they are reported in the checkmarx report. I know we can write in if ...
1
vote
1answer
235 views

Salesforce security review - ID field fls create

In salesforce security review am getting a error FLS create which is for ID field. so when a FLS create error occurred, validated the isCreateable or isUpdatebale for update condtion. Here how to ...
1
vote
1answer
80 views

Error from security review

if(dupObjDel !=null && dupObjDel.size() > 0 ) { if(isSafeObjectDel( dupObjDel ) ) { delete dupObjDel; // ERROR in this line } } public ...
1
vote
1answer
224 views

checkmarx scanner results for custom settings

I get a lot of CRUD/FLS security risks on the checkmarx scanner results while scanning our managed package. Does one need CRUD/FLS checks on public custom settings or can they be considered as false ...
1
vote
1answer
293 views

SOQL Injection Error in Checkmarx Scanner Report

I have a query similar to this in one of our apps, List<Account> accountList = Database.query('SELECT Id,Name FROM Account WHERE Id IN:accIds'); But Checkmarx always gives SOQL Injection ...
1
vote
0answers
64 views

The CheckMarx security scanner gives error on Client Potential XSS vulnerability [closed]

In the code scanning, I am facing the Client Potential XSS issue. Scan Result: Can anyone please provide me any solution on this? Thanks, Ragav
1
vote
0answers
268 views

checkmarx scan Dereferenced Field issue

I submitted code in checkmarx and in the result i got error as "Dereferenced Field" on following lines : source as : .... 61. else return new PageReference('/'+Vendor_Invoice_Line__c.sobjecttype....
1
vote
0answers
217 views

DML on page action

I have the following situation in my plate ... On page load, a modal pops up. The modal is invoked on an action attribute in apex:page. The method that is on the action has an upsert operation that ...
1
vote
1answer
126 views

How to resolve Bulkify apex methods using collections in methods (Chckmarx issue)? [closed]

I have submitted my code for security review and got a few warnings for the Bulkify Apex Methods Using Collections In Methods. I have read the code best practices and also some stack exchange posts ...
0
votes
2answers
222 views

Checkmarx Scanner is usless for CRUD and FLS issues checking?

Checkmarx report field Id (User Object) as FLS Create violation whenever the code checks for OwnerId (Account Object) field is createable. Is it false-positive result or can I enforce FLS somehow to ...
0
votes
1answer
259 views

The CheckMarx security scanner says that these lines is a Stored XSS

Do not know why checkmarx throwing these errors. As there is nothing that needs to be HTMLENCODE. Although VF page showing the data that is being added from Line 344 and 345 from a <apex:...
0
votes
1answer
873 views

Source Scanner Cross Site Request Forgery (XSRF) spanning apex:commandButton

I'm getting results back from the source scanner for XSRF issues where the result path spans an apex:commandButton. A number of the XSRF paths in my report follow a pattern: In the controllers ...
0
votes
1answer
83 views

RichText area field not eliminating XSS issue in checkmarx

I am writing escape=false in my VF Page like this. <apex:outputText escape="false" value="{!cr.Message__c}" rendered="{!(cr.Message__c)!= ''}"/><br/><br/> The Mesage__c is a custom ...
0
votes
1answer
119 views

Code Scanner Report Query: XSRF Apex Serious Security Risk [duplicate]

I ran CheckMarx security code scanner and found this 1 security risk issue for a Button on Opportunity that opens a VF page (generates pdf). From the code report, here is the issue mentioned. Can ...
0
votes
1answer
220 views

Salesforce Checkmarx Integration

We need to setup the CheckMarx code scanner eclipse plug-in for Salesforce org. While scanning from eclipse we are getting the server connection error massage : 1. We have downloaded the CxSAST ...
0
votes
1answer
521 views

Client Cross Frame Scripting Attack by Checkmarx scanner for visualforce component, [duplicate]

I am Using visualforce component for insert and updating child record. this component is reusable for multiple objects, like account, contact, etc., as like we can use this. I am doing DML inside a ...
0
votes
0answers
3k views

ISCLONE() and Workflow Rules against CLONED records

I am trying to create some business logic that resets a cloned Opportunity check-box field to FALSE if that Opportunity record is cloned (our sales team will clone opportunities with the same accounts ...
0
votes
1answer
68 views

Checkmarx results for appExchange entries

Our company's internal Information Security folks are used to using Veracode to scan web & app code. I understand appExchange entries are scanned via SFDC / Checkmarx. My question is: Is there ...
-1
votes
2answers
309 views

Query: SOQL SOSL Injection in Security Review

While passing the app, I am still getting SOQL Injection errors in checkmarx. Please advise why this is: L 435: query += fmw.LeadFieldName + ', '; L 437: query = query.substring(0 , query.length()-2)...