8
votes
Accepted
Why Is Checkmarx Taking So Long To Complete?
From my personal experience as an ISV employee, I can say that this is pretty normal during the weeks leading up to a release. Here's the problem: ISVs are given about a month before the release hits ...
- 502k
8
votes
Accepted
Strange error is showing when trying to open partner security portal with primary partner community user
After I opened a Salesforce support case, I was told to open the following link https://login.salesforce.com/services/auth/sso/00D30000000JsbiEAC/Chimera?site=https://security.secure.force.com/chimera
...
- 17.8k
6
votes
Accepted
Resubmit for Security Review without Patches
If there are bugs that require urgent fixing against previous versions of the package, before you will get through Security Review, this needs to be resolved by raising a case with Salesforce against ...
- 38.1k
5
votes
Accepted
Bulkify Apex Methods Using Collections In Methods false positive?
Seems like a false positive. In most cases a method that accepts a single record and performs a DML Operation on it might be called in a loop, and hence be considered non-bulk-safe. However, ...
- 151k
5
votes
Accepted
Checkmarx Scanner is useless for CRUD and FLS issues checking?
Checkmarx is not "useless," and, in fact, is very good at what it does. However, that's not to say that false positives are not possible. It can make mistakes. However, whenever you get a flag like ...
- 502k
5
votes
Checkmarx Force.com Security Source Scanner - any way to mark known false-positives?
You really only have two choices: fix the code so it no longer generates the false positive, or live with it. The first almost always results in suboptimal code changes, such as purposefully calling ...
- 502k
5
votes
Accepted
Query: FLS Create issue while running checkmarx
The Checkmarx tool explains the entire path for a specific error. In other words, there is only one error, and those are all the steps that were taken to explain that conclusion. Working backwards, ...
- 502k
4
votes
Accepted
Checkmarx Code Quality Warning
This is almost certainly a false positive, although it may simply be complaining since your code does not explicitly handle the case where dsamList throws an error. I would advise simply ignoring this ...
- 502k
3
votes
Accepted
FLS Create Security Risk still appears even though object is checked if it is creatable
Fields and objects each have their own security. You are expected to check every object and field, e.g. MyCustomObject__c.field1__c.getDescribe().isCreateable(). You can simplify these checks with ...
- 502k
3
votes
Checkmarx Reflected XSS with getParameter
You need to use JSENCODE by itself, without trying to make your own JSON string, or you need to serialize the entire JSON object and use that instead.
The reason why stripHtml4 and escapeSingleQuotes ...
- 502k
3
votes
Prevent CRUD Delete/Insert/Update Checkmarx Issue for SObject in Apex Code
If you are submitting your app for security review ,you will need to enforce CRUD-FLS for all your DML and SOQL since apex does not enforce it automatically.
There is a blog post link below that ...
3
votes
How to resolve Cross Site Request Forgery(CSRF) in salesforce?
Checkmarx is going to flag this code for CSRF because the action is performed automatically with a GET Request (page load). The only solution is to move the code out of the page action and into an ...
- 3,264
2
votes
Accepted
Query: SOQL SOSL Injection in Security Review
You need to escape the values that you are using to construct the query to prevent an attacker supplying malicious data that would result in unexpected action or returning additional data fields. In ...
- 93.7k
2
votes
Accepted
checkmarx exception for dynamic DML, Ex: insert operation on input from method param
Technically, you're at risk for SOQL injection, hence this error. You've mitigated it somewhat by only allowing a single word, but you might still run in problems if someone tries to use an apostrophe ...
- 502k
2
votes
Accepted
Checkmarx Security Scanner FLS Issues
In our experience:
Checkmarx does actually have a limit (500 or there abouts) for any one of the types of security issue that it will find (we know this because we have 1000s of CRUD/FLS false ...
- 38.1k
2
votes
Second order SOQl/SOSL injection error during checkmarx scan
Another way to indisputably remove any injection vulnerability is to use a merge variable instead.
'WHERE Id = :originalId'
- 151k
2
votes
How should we fix Client potential XSS for InnerText and InnerHTML
Essentially, this problem arises because the inner text of the "svg" element could in principle be text (not HTML) like:
<script>do something nasty here</script>
When you assign ...
- 38.1k
2
votes
Best (commercial) Scanner to stay prepared for Security Review
Did you consider trying out Snyk? It launched Apex support back in October but I haven't done a deep-dive yet. I didn't see it in your list, so I thought it would be worth mentioning.
https://snyk.io/...
- 234
2
votes
Lightning DOM XSS Injection Issue Reported in Checkmarx
The iframe src attribute can be used to execute malicious javascript code (see here). For example, testDummyurl could equal the code below, which would cause an alert message to appear when the user ...
- 336
2
votes
Accepted
Is fixing "Apex Code Quality" issues necessary for passing security review?
As stated in the documentation, you must fix:
All issues regardless of severity level that aren’t labeled “Code Quality”.
As long as you meet this requirement, you will be fine. Just don't wait too ...
- 502k
2
votes
SOQl Injection Checkmarx issues
Since you're using variable binding, it's a false positive.
Indeed, as stated in this trailhead about Mitigate SOQL Injection
The first and most recommended method to prevent SOQL injection is to use ...
- 9,582
1
vote
Accepted
Checkmarx - Bulkify Apex Methods Using Collections In Methods
Two points:
This is probably a coding practice/style warning which is not relevant to a security review (but that is worth addressing to make your code perform better);
Checkmarx never flags all ...
- 38.1k
1
vote
Package review fails with new undocumented issues
Why don't those appear in my own Checkmarx / Security Scanner runs?
Possibly false negatives? It's hard to tell without seeing the code in question and the scanner results; you may need to log a bug ...
- 502k
1
vote
How to run Source Code Scanner / Checkmarx against a Scratch Org?
If you run your scan through the partner security portal, on https://security.secure.force.com/sourcescanner/PackageScannerMain, then you will find that you select package versions, not orgs, for the ...
- 38.1k
1
vote
Checkmarx FLS Update validation
This posting does not actually pose a question and doesn't appear to include the relevant part of the code for the headline issue. You suggest it is a CRUD/FLS issue but the description suggests a SQL ...
- 38.1k
1
vote
Fix checkmarx report issue Client DOM XSRF
parent.location = self.location; is used for reloading the page. Since, you are assigning the location, there is a chance that parameters can also be assigned directly which in-turn can modify ...
- 24.5k
1
vote
Accepted
Checkmarx XSS Vulnerability with Lightning.CreateComponent
When you use JSENCODE, it adds \ (backslash). Then you can decode it in lightning component on init by using decodeURI(component.get("v.attributes"))
$Lightning.use("c:AccountApp", function() {
...
- 24.5k
1
vote
Query: SOQL SOSL Injection in Security Review
When building a dynamic query, always make sure the user can access the fields, otherwise they may expose data not meant to be seen:
Map<String, SOBjectField> fields = SObjectType.Lead.fields....
- 502k
1
vote
RichText area field not eliminating XSS issue in checkmarx
The Salesforce database automatically scrubs rich text fields of all unsupported tags. The list of supported tags and attributes are found in the Rich Text Editor help. As such, this is probably a ...
- 502k
1
vote
Accepted
check FLS and CRUD for more than one field
You can get a list of all createable fields through this way:
public static Set<String> getCreateableFields(Schema.SObjectType objectType) {
Set<String> createableFields = new Set<...
- 5,822
Only top scored, non community-wiki answers of a minimum length are eligible