Questions tagged [security-scanner]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
24 views

How to pass Salesforce Code Scanner Result when using “global class”

I failed to pass Salesforce Code Scanner result for an app that has classes using the "without sharing" keyword, Global Class and global static methods. I implemented the feature management that's why ...
1
vote
1answer
68 views

FLS Create Error

My code on scanner report gives some FLS Create errors code like this public static cg__SURL__c upsertPublicLink(cg__SURL__c sUrl){ if (String.isEmpty(sURL.cg__SUrl_Id__c)) { String ...
-1
votes
1answer
90 views

How to solve Reflected XSS error in query referenced in my Visualforce Component

When I sent my code to security scan I got Reflected XSS error. How to solve this issue? I wrapped the variable with Jsencode. Visualforce component is not saving. Below is the code where I got that ...
1
vote
1answer
103 views

check FLS and CRUD for more than one field

I have a code which inserts custom Note__c object by using 5 fields. I want to check FLS and CRUD permission field level wise as they are reported in the checkmarx report. I know we can write in if ...
6
votes
2answers
671 views

Checkmarx Force.com Security Source Scanner - any way to mark known false-positives?

For the Force.com Security Source Scanner, is there a mechanism of the same nature as eslint-disable-line for inhibiting known false-positive reports? With the false positives excluded, future scans ...
1
vote
2answers
35 views

Force.com Source Scanner Results to CSV/JSON

Has anyone found a nifty way to convert results from the Force.com Source Scanner into CSV or JSON? I have over 300 small issues (mainly API version and FLS Creates), and want to push them into our ...
6
votes
1answer
163 views

SOQL inside a While loop is not detected in Security review

Noticed a weird thing, SOQL inside a for loop is a bad practice but in a while loop isn't? Force.com security scanner has not detected a SOQL inside a while loop and also note that our paid ...
0
votes
1answer
119 views

Code Scanner Report Query: XSRF Apex Serious Security Risk [duplicate]

I ran CheckMarx security code scanner and found this 1 security risk issue for a Button on Opportunity that opens a VF page (generates pdf). From the code report, here is the issue mentioned. Can ...
3
votes
0answers
84 views

How to generate scan results for the external endpoints to pass salesforce security review?

I have build Salesforce appexchange app and i have used amazon s3 server api to store files in amazon server. I have generated the report for security and quality check but i dont know how to generate ...
2
votes
1answer
81 views

Security reviews in Salesforce

A monthly report is being run by our client to check the security of their portal on Salesforce. The report is run using TrustWave. Problem: A threat that report shows is known as Sweet32 or the ...
1
vote
0answers
110 views

FLS Update for id field

In the case of record update, we will use the Id field to specify Id value. How to check FLS for Id field. I have already check isAccesible method. But still, it shows in the security scanner. Is it a ...
8
votes
2answers
109 views

Security scanner working procedure?

I have submitted my org a week before in Security scanner and it was in queue for a long time. After which I updated our apex codes in the submitted org. So I would like to know whether updated code ...
5
votes
1answer
553 views

Why Is Checkmarx Taking So Long To Complete? [closed]

Recently submitted an app to the Force.com source code scanner by CheckMarx, after 5 days still there is no sign of scanning report. It will be helpful if that tool tells some approx waiting period. ...
1
vote
1answer
33 views

Trying to resolve the security scanner issue creates problem while installing the managed package?

The following class inserts Data in a custom object(SAPConfiguration__c),when a user enters data in a Visualforce page. In order to rectify the Security Scanner issue(Query: FLS Create) I have added ...
9
votes
2answers
345 views

Does assert methods needed in @testSetup?

I ran force.com security scan on my managed package i got the following report Query: Test Methods With No Assert L 4: @testSetup static void defConnSetup(){ so is it necessary to add assertion ...
1
vote
1answer
352 views

FLS Create for upsert

How manage FLS Create issues in Checkmarx for upsert statements ? I use isCreateable() for insert and isUpdateable() for update. But for upsert, I don't know what function I have to use (one or both)...
3
votes
1answer
873 views

“Client Cross Frame Scripting Attack” by Checkmarx Scanner for Visualforce component

I have got the Client Cross Frame Scripting Attack alert in the recent CheckMarx scanner. However, it points to an auto generated ID. I've seen the following links however, the I'm not sure about ...
1
vote
1answer
37 views

How to use the security scanner when you need your code in a package?

I'm creating a package in a Developer Edition and there's a couple reasons why I want to keep all my components (apex code, visualforce pages, etc) in a package. It lets me subscribe to the ...
0
votes
0answers
39 views

Force.com Scanner not working

We are trying to use force.com code scanner for security check.We have provided the credentials of our org multiple times,but each time when we try scanning our org,it shows the same error every time ...
2
votes
0answers
89 views

Is it that there are alternatives to the security scan salesforce?

I'm wondering if there is some third party alternative or any alternative to the Force.com Security Source Code Scanner. I have ask to scan my org 1 week ago and I haven't get an answer yet. I have ...
1
vote
2answers
146 views

Security scanner not giving updates

I created some Apex code in a Developer Org and I wanted to try to scan it before my security review so I submitted my username on Friday, here: https://security.secure.force.com/...
1
vote
2answers
147 views

How to submit to the security scanner in a developer org?

I've reached the point where I'd like to scan my Apex code, but up until now it's all been written in a Developer Org. The scanner asks for a username only - how can I specify that the code I want ...
4
votes
1answer
198 views

Stored XSS - Salesforce security check ( AngularJS) error

I am getting an error while security check Category : cross-site scripting , Stored XSS for below $scope.nameMap = {!nameMap}; For javaScript we have some encoding methos but i didn't found such ...
2
votes
1answer
120 views

Salesforce periodic security review process

I have a Salesforce App which passed security review for the first time in the last year. This App also includes integration with external web application, due to this I also submitted a BURP scan ...
3
votes
1answer
1k views

How to solve Async Future Method Inside Loops Issue?

Can any one please help me solving this, The below trigger will create an guid(random_string) and it will be passed to an controller and from controller i'm hitting the Post the data to our URL. ...
8
votes
4answers
871 views

Genuine SOQL Injection issue or False Positive?

Trying to work out if this a valid issue with my code, or just a false positive I can note in report for Security Review. I have provided a slightly simplified version below. The Id I am querying for ...
2
votes
1answer
96 views

Security Review Scanner help

I ran the checkmarx security scanner and I got 1 item flagged as a "Bulkify Apex Methods" but I'm not 100% sure I get what's the issue there. Here's a screenshot of the Checkmarx issue. Can you ...
1
vote
2answers
181 views

Cloud security scanner issues?

I submitted a scan yesterday : http://security.force.com/security/tools/forcecom/scanner Normally, I get an email informing me that the scan is put in the queue and then another mail to give me the ...
0
votes
1answer
873 views

Source Scanner Cross Site Request Forgery (XSRF) spanning apex:commandButton

I'm getting results back from the source scanner for XSRF issues where the result path spans an apex:commandButton. A number of the XSRF paths in my report follow a pattern: In the controllers ...
6
votes
2answers
1k views

Force.com Security Source Scanner

I have developed an app in my Dev org and am in the process of publishing it. Prior to the publishing steps, I wanted to perform a security scan on my entire code and I happen to land in the following ...
2
votes
1answer
846 views

Salesforce checkmarx security scan

Recently I put my code through the free checkmarx code scanner provided by salesforce. It gave me a stored XSS issue. But the piece of code which was identified has been in my codebase since a long ...
3
votes
2answers
113 views

Is it required for Security Scanner - global with sharing myBatch implement Database.Batachable<sObject>

I am about send my package for Security Scanner, So Is there any requirement to add "with Sharing" for all of my Batch Classes. global with sharing myBatch implement Database.Batachable<sObject>...
1
vote
3answers
375 views

How do you do a Security Source Scan of managed or unmanaged packages?

Under the requirements for the Force.com Security Source Scanner it states: Source code that lives inside of managed or unmanaged packages is not scanned to avoid inadvertently scanning code ...
7
votes
2answers
115 views

Security Scanner not finding assertion

I have been using the Salesforce Security Scanner to scan my code: http://security.force.com/security/tools/forcecom/scanner Basically, the scan is telling me that I do not have any assert ...