Skip to main content
8 votes
Accepted

Why Is Checkmarx Taking So Long To Complete?

From my personal experience as an ISV employee, I can say that this is pretty normal during the weeks leading up to a release. Here's the problem: ISVs are given about a month before the release hits ...
sfdcfox's user avatar
  • 495k
8 votes
Accepted

Strange error is showing when trying to open partner security portal with primary partner community user

After I opened a Salesforce support case, I was told to open the following link https://login.salesforce.com/services/auth/sso/00D30000000JsbiEAC/Chimera?site=https://security.secure.force.com/chimera ...
Patlatus's user avatar
  • 17.2k
6 votes
Accepted

Resubmit for Security Review without Patches

If there are bugs that require urgent fixing against previous versions of the package, before you will get through Security Review, this needs to be resolved by raising a case with Salesforce against ...
Phil W's user avatar
  • 36.8k
5 votes

Checkmarx Force.com Security Source Scanner - any way to mark known false-positives?

You really only have two choices: fix the code so it no longer generates the false positive, or live with it. The first almost always results in suboptimal code changes, such as purposefully calling ...
sfdcfox's user avatar
  • 495k
5 votes
Accepted

Checkmarx Scanner is useless for CRUD and FLS issues checking?

Checkmarx is not "useless," and, in fact, is very good at what it does. However, that's not to say that false positives are not possible. It can make mistakes. However, whenever you get a flag like ...
sfdcfox's user avatar
  • 495k
5 votes
Accepted

The CheckMarx security scanner says that these lines is a Query: XSRF Error

Performing any DML during a page's action method is a security concern. This is because people can cause your code to run without the user's consent. For example, consider what happens if someone puts ...
sfdcfox's user avatar
  • 495k
5 votes
Accepted

Bulkify Apex Methods Using Collections In Methods false positive?

Seems like a false positive. In most cases a method that accepts a single record and performs a DML Operation on it might be called in a loop, and hence be considered non-bulk-safe. However, ...
Adrian Larson's user avatar
  • 150k
5 votes
Accepted

Query: FLS Create issue while running checkmarx

The Checkmarx tool explains the entire path for a specific error. In other words, there is only one error, and those are all the steps that were taken to explain that conclusion. Working backwards, ...
sfdcfox's user avatar
  • 495k
4 votes
Accepted

Checkmarx Code Quality Warning

This is almost certainly a false positive, although it may simply be complaining since your code does not explicitly handle the case where dsamList throws an error. I would advise simply ignoring this ...
sfdcfox's user avatar
  • 495k
3 votes
Accepted

FLS Create Security Risk still appears even though object is checked if it is creatable

Fields and objects each have their own security. You are expected to check every object and field, e.g. MyCustomObject__c.field1__c.getDescribe().isCreateable(). You can simplify these checks with ...
sfdcfox's user avatar
  • 495k
3 votes

Checkmarx Reflected XSS with getParameter

You need to use JSENCODE by itself, without trying to make your own JSON string, or you need to serialize the entire JSON object and use that instead. The reason why stripHtml4 and escapeSingleQuotes ...
sfdcfox's user avatar
  • 495k
3 votes

Prevent CRUD Delete/Insert/Update Checkmarx Issue for SObject in Apex Code

If you are submitting your app for security review ,you will need to enforce CRUD-FLS for all your DML and SOQL since apex does not enforce it automatically. There is a blog post link below that ...
Mohith Shrivastava's user avatar
3 votes

"Client Cross Frame Scripting Attack" by Checkmarx Scanner for Visualforce component

This looks like a false positive. There are false positives with every query, of course, and we regularly review these queries. Going forward, we are going to remove this query from our security ...
Robert Sussland's user avatar
3 votes

How to resolve Cross Site Request Forgery(CSRF) in salesforce?

Checkmarx is going to flag this code for CSRF because the action is performed automatically with a GET Request (page load). The only solution is to move the code out of the page action and into an ...
Robert Sussland's user avatar
2 votes
Accepted

The CheckMarx security scanner says that these lines is a Stored XSS

The scanner is correct, a stored XSS attack is possible from that code. I don't believe this can be handled by HTMLENCODE() in your Visualforce. With that in mind, you probably need to use String....
Derek F's user avatar
  • 62.3k
2 votes
Accepted

Query: SOQL SOSL Injection in Security Review

You need to escape the values that you are using to construct the query to prevent an attacker supplying malicious data that would result in unexpected action or returning additional data fields. In ...
David Reed's user avatar
  • 93.2k
2 votes
Accepted

checkmarx exception for dynamic DML, Ex: insert operation on input from method param

Technically, you're at risk for SOQL injection, hence this error. You've mitigated it somewhat by only allowing a single word, but you might still run in problems if someone tries to use an apostrophe ...
sfdcfox's user avatar
  • 495k
2 votes

Second order SOQl/SOSL injection error during checkmarx scan

Another way to indisputably remove any injection vulnerability is to use a merge variable instead. 'WHERE Id = :originalId'
Adrian Larson's user avatar
  • 150k
2 votes

How should we fix Client potential XSS for InnerText and InnerHTML

Essentially, this problem arises because the inner text of the "svg" element could in principle be text (not HTML) like: <script>do something nasty here</script> When you assign ...
Phil W's user avatar
  • 36.8k
2 votes
Accepted

Checkmarx Security Scanner FLS Issues

In our experience: Checkmarx does actually have a limit (500 or there abouts) for any one of the types of security issue that it will find (we know this because we have 1000s of CRUD/FLS false ...
Phil W's user avatar
  • 36.8k
2 votes

Lightning DOM XSS Injection Issue Reported in Checkmarx

The iframe src attribute can be used to execute malicious javascript code (see here). For example, testDummyurl could equal the code below, which would cause an alert message to appear when the user ...
Tyler Campbell's user avatar
2 votes

Best (commercial) Scanner to stay prepared for Security Review

Did you consider trying out Snyk? It launched Apex support back in October but I haven't done a deep-dive yet. I didn't see it in your list, so I thought it would be worth mentioning. https://snyk.io/...
nicolas's user avatar
  • 234
2 votes
Accepted

Is fixing "Apex Code Quality" issues necessary for passing security review?

As stated in the documentation, you must fix: All issues regardless of severity level that aren’t labeled “Code Quality”. As long as you meet this requirement, you will be fine. Just don't wait too ...
sfdcfox's user avatar
  • 495k
2 votes

SOQl Injection Checkmarx issues

Since you're using variable binding, it's a false positive. Indeed, as stated in this trailhead about Mitigate SOQL Injection The first and most recommended method to prevent SOQL injection is to use ...
RubenDG's user avatar
  • 8,592
1 vote
Accepted

Checkmarx - Bulkify Apex Methods Using Collections In Methods

Two points: This is probably a coding practice/style warning which is not relevant to a security review (but that is worth addressing to make your code perform better); Checkmarx never flags all ...
Phil W's user avatar
  • 36.8k
1 vote

Checkmarx FLS Update validation

This posting does not actually pose a question and doesn't appear to include the relevant part of the code for the headline issue. You suggest it is a CRUD/FLS issue but the description suggests a SQL ...
Phil W's user avatar
  • 36.8k
1 vote

Package review fails with new undocumented issues

Why don't those appear in my own Checkmarx / Security Scanner runs? Possibly false negatives? It's hard to tell without seeing the code in question and the scanner results; you may need to log a bug ...
sfdcfox's user avatar
  • 495k
1 vote

How to run Source Code Scanner / Checkmarx against a Scratch Org?

If you run your scan through the partner security portal, on https://security.secure.force.com/sourcescanner/PackageScannerMain, then you will find that you select package versions, not orgs, for the ...
Phil W's user avatar
  • 36.8k
1 vote

Fix checkmarx report issue Client DOM XSRF

parent.location = self.location; is used for reloading the page. Since, you are assigning the location, there is a chance that parameters can also be assigned directly which in-turn can modify ...
salesforce-sas's user avatar
1 vote
Accepted

Checkmarx XSS Vulnerability with Lightning.CreateComponent

When you use JSENCODE, it adds \ (backslash). Then you can decode it in lightning component on init by using decodeURI(component.get("v.attributes")) $Lightning.use("c:AccountApp", function() { ...
salesforce-sas's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible