2022 Developer Survey is open! Take survey.
7 votes
Accepted

Why Is Checkmarx Taking So Long To Complete?

From my personal experience as an ISV employee, I can say that this is pretty normal during the weeks leading up to a release. Here's the problem: ISVs are given about a month before the release hits ...
user avatar
  • 430k
6 votes
Accepted

Genuine SOQL Injection issue or False Positive?

If you want to be cautious, you can check that it is an actual field first. Possibly easier to sanitize input than enforce namespace. public static List<Contact> safeQuery(MyCustomSetting__c ...
user avatar
  • 142k
5 votes
Accepted

Does assert methods needed in @testSetup?

No, you don't need to include Asserts in @TestSetup methods. You could make a note of the fact that this is such a method in your False Positives document that should accompany the security scan ...
user avatar
5 votes
Accepted

How to submit to the security scanner in a developer org?

The question here is about running the Security Scanner (NOT on how to conduct a Security Review for AppExchange apps). To do so, all you need to ensure is that your code resides in a loose form (not ...
user avatar
5 votes

Genuine SOQL Injection issue or False Positive?

It could be an SOQL injection issue depending on how the overall application populates the custom setting. If the user has access to populate the custom setting then they could populate it with a ...
user avatar
  • 53.1k
5 votes
Accepted

URL Redirect Attack - Apex

You're allowing the attacker to use any arbitrary input, so they can inject extra parameters, etc. I think what the security scanner is looking for is EncodingUtil.urlEncode: String url = '/' + ...
user avatar
  • 430k
4 votes

Is it required for Security Scanner - global with sharing myBatch implement Database.Batachable<sObject>

I have just submitted a security scanner and did not add with sharing to my batch classes. The scanner did not complain. However it is allowable to have a class that is without sharing that pops up a ...
user avatar
4 votes

Salesforce checkmarx security scan

You should view the security scanner as non-deterministic because 1) The Checkmarx queries are occasionally updated to try to reduce false positives and detect more true positives 2) The engine ...
user avatar
4 votes
Accepted

How to solve Async Future Method Inside Loops Issue?

When a trigger executes each invocation may have up to 200 records. So, if 200 or more app__c records were updated in a single transaction the following loop would run 200 times for the first ...
user avatar
4 votes
Accepted

Force.com Security Source Scanner

Here is the "Official" answer: The 500,000 line of code limit is a limit that Salesforce imposes on the size of a single scan. This is because 1) larger scans will probably time out on most queries ...
user avatar
4 votes
Accepted

Security scanner working procedure?

I had a call with CheckMarx customer care. He mentioned that if the submitted org is in queue then it is not yet scanned. So on the time of scanning whatever code available in the org will be ...
user avatar
4 votes

Checkmarx Force.com Security Source Scanner - any way to mark known false-positives?

You really only have two choices: fix the code so it no longer generates the false positive, or live with it. The first almost always results in suboptimal code changes, such as purposefully calling ...
user avatar
  • 430k
3 votes
Accepted

Security scanner not giving updates

Does it normally take this long? It really does depend on volume. Especially shortly before and after a release, you can expect a wait time of up to a few weeks (the longest I've seen is about 14 ...
user avatar
  • 430k
3 votes

Stored XSS - Salesforce security check ( AngularJS) error

You will have to JSENCODE the getter variable , $scope.nameMap = '{!JSENCODE(nameMap)}' //If you are expecting just JSON string If you need to further parse into JSON object use Javascript JSON....
user avatar
3 votes

"Client Cross Frame Scripting Attack" by Checkmarx Scanner for Visualforce component

This looks like a false positive. There are false positives with every query, of course, and we regularly review these queries. Going forward, we are going to remove this query from our security ...
user avatar
3 votes
Accepted

Cloud security scanner issues?

There are no issues . Its just that scanner is under heavy load. They hove took your request and kept it in queue. It will get process when you get your turn. Dont worry it may take up to one or two ...
user avatar
  • 8,980
3 votes
Accepted

Security Scanner not finding assertion

I found the culprit on my own. I noticed that the System.RunAs(new User(Id = UserInfo.getUserId())) the previous developer used essentially does nothing at all. I removed that as well as put asserts ...
user avatar
  • 6,009
3 votes

Security Scanner not finding assertion

I cannot see anything particularly wrong with your code above, your using a number of variations of System.assert vs System.assertEquals as well, so it's not as if it may favour one over the other for ...
user avatar
3 votes
Accepted

SOQL inside a While loop is not detected in Security review

Neither PMD nor the Code Scanner consider this pattern to be a code violation for "SOQL inside a loop." That type of rule is more concerned with code that is not bulkified (e.g. using multiple queries ...
user avatar
  • 430k
3 votes

How to solve Reflected XSS error in query referenced in my Visualforce Component

Lets first understand what is XSS and see what are the possible ways to prevent this Cross-site scripting(XSS) is a vulnerability that occurs when an attacker can insert unauthorized JavaScript, ...
user avatar
2 votes

How do you do a Security Source Scan of managed or unmanaged packages?

No packaged code is scanned, whether managed or unmanaged. There is a legitimate use case to scan unmanaged packages, but there is a workaround to deploying the code into a DE org directly, so this ...
user avatar
2 votes
Accepted

How do you do a Security Source Scan of managed or unmanaged packages?

We've been working on NPSP 3.0 for the last 9 months and are getting very close to a release. The new version is currently under security review as part of the standard process for listing on the ...
user avatar
  • 2,030
2 votes

How do you do a Security Source Scan of managed or unmanaged packages?

It means that if your application uses a managed package then that managed package will not be scanned The scanner will only scan the namespace of the org that the scan is being run on. So if you are ...
user avatar
  • 53.1k
2 votes
Accepted

Source Scanner Cross Site Request Forgery (XSRF) spanning apex:commandButton

The issue is a bit complex. Yes, the path cited is a false positive, however in general Checkmarx will flag these only when there is a real issue. The error is that it is reporting too many paths. ...
user avatar
2 votes

Force.com Security Source Scanner

The "official" words from the Salesforce Security twitter account are: "Checkmarx allows us to give all customers 30k lines for free." "Limits for partners are slightly different. The limit is ...
user avatar
2 votes

Genuine SOQL Injection issue or False Positive?

Perhaps this is prevented in your full query, but in the one provided a person can enumerate valid contact IDs, and any which match a custom setting would appear to complete the query, allowing anyone ...
user avatar
2 votes
Accepted

FLS Create for upsert

You need to check both isCreateable() and isUpdateable() for upsert.
user avatar
  • 3,873
2 votes
Accepted

How to use the security scanner when you need your code in a package?

It doesn't scan code in installed packages. It scans just the code that is native to the org. There's no problem with just pointing the scanner at your existing org.
user avatar
  • 430k
2 votes

How to submit to the security scanner in a developer org?

Up till now, i have got done some security reviews, out of which all of them were developed in developer orgs. As per Salesforce, Package should be developed in developer org and its must if its ...
user avatar
  • 1,464
2 votes

Does assert methods needed in @testSetup?

The missing assert rule for Checkmarx is a quality rule, not a security rule. Quality rules are not relevant for the security review -- you can run the scan to be security rules only if you want. ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible