8
votes
Accepted
Why Is Checkmarx Taking So Long To Complete?
From my personal experience as an ISV employee, I can say that this is pretty normal during the weeks leading up to a release. Here's the problem: ISVs are given about a month before the release hits ...
- 476k
7
votes
Accepted
Strange error is showing when trying to open partner security portal with primary partner community user
After I opened a Salesforce support case, I was told to open the following link https://login.salesforce.com/services/auth/sso/00D30000000JsbiEAC/Chimera?site=https://security.secure.force.com/chimera
...
- 15.8k
6
votes
Accepted
Genuine SOQL Injection issue or False Positive?
If you want to be cautious, you can check that it is an actual field first. Possibly easier to sanitize input than enforce namespace.
public static List<Contact> safeQuery(MyCustomSetting__c ...
- 149k
6
votes
Accepted
How can I mitigate URL redirection attacks?
You're allowing the attacker to use any arbitrary input, so they can inject extra parameters, etc. I think what the security scanner is looking for is EncodingUtil.urlEncode:
String url = '/' + ...
- 476k
5
votes
Checkmarx Force.com Security Source Scanner - any way to mark known false-positives?
You really only have two choices: fix the code so it no longer generates the false positive, or live with it. The first almost always results in suboptimal code changes, such as purposefully calling ...
- 476k
5
votes
Accepted
Does assert methods needed in @testSetup?
No, you don't need to include Asserts in @TestSetup methods.
You could make a note of the fact that this is such a method in your False Positives document that should accompany the security scan ...
- 6,746
5
votes
Accepted
How to submit to the security scanner in a developer org?
The question here is about running the Security Scanner (NOT on how to conduct a Security Review for AppExchange apps). To do so, all you need to ensure is that your code resides in a loose form (not ...
- 15.5k
5
votes
Genuine SOQL Injection issue or False Positive?
It could be an SOQL injection issue depending on how the overall application populates the custom setting.
If the user has access to populate the custom setting then they could populate it with a ...
- 53.9k
4
votes
Accepted
How to solve Async Future Method Inside Loops Issue?
When a trigger executes each invocation may have up to 200 records. So, if 200 or more app__c records were updated in a single transaction the following loop would run 200 times for the first ...
- 102k
4
votes
Accepted
Security scanner working procedure?
I had a call with CheckMarx customer care.
He mentioned that if the submitted org is in queue then it is not yet scanned. So on the time of scanning whatever code available in the org will be ...
- 1,329
3
votes
Accepted
SOQL inside a While loop is not detected in Security review
Neither PMD nor the Code Scanner consider this pattern to be a code violation for "SOQL inside a loop." That type of rule is more concerned with code that is not bulkified (e.g. using multiple queries ...
- 476k
3
votes
How to solve Reflected XSS error in query referenced in my Visualforce Component
Lets first understand what is XSS and see what are the possible ways to prevent this
Cross-site scripting(XSS) is a vulnerability that occurs when an
attacker can insert unauthorized JavaScript, ...
- 820
3
votes
Accepted
Security scanner not giving updates
Does it normally take this long?
It really does depend on volume. Especially shortly before and after a release, you can expect a wait time of up to a few weeks (the longest I've seen is about 14 ...
- 476k
3
votes
"Client Cross Frame Scripting Attack" by Checkmarx Scanner for Visualforce component
This looks like a false positive. There are false positives with every query, of course, and we regularly review these queries. Going forward, we are going to remove this query from our security ...
- 3,196
3
votes
Stored XSS - Salesforce security check ( AngularJS) error
You will have to JSENCODE the getter variable ,
$scope.nameMap = '{!JSENCODE(nameMap)}' //If you are expecting just JSON string
If you need to further parse into JSON object use Javascript JSON....
- 90.1k
3
votes
Accepted
Using SOQL Injection to delete data
Apex compiler will error out as you cannot provide apex statement as string and then expect compiler to compile automatically.
- 90.1k
3
votes
Using SOQL Injection to delete data
SOQL and SQL are distant cousins. Unlike SQL, you cannot have multiple statements in SOQL, can't execute arbitrary Apex, and you can't even perform DML statements of any kind. As such, the absolutely ...
- 476k
2
votes
Genuine SOQL Injection issue or False Positive?
Perhaps this is prevented in your full query, but in the one provided a person can enumerate valid contact IDs, and any which match a custom setting would appear to complete the query, allowing anyone ...
- 4,228
2
votes
How to submit to the security scanner in a developer org?
Up till now, i have got done some security reviews, out of which all of them were developed in developer orgs.
As per Salesforce, Package should be developed in developer org and its must if its ...
- 1,492
2
votes
Accepted
2
votes
Accepted
How to use the security scanner when you need your code in a package?
It doesn't scan code in installed packages. It scans just the code that is native to the org. There's no problem with just pointing the scanner at your existing org.
- 476k
2
votes
Does assert methods needed in @testSetup?
The missing assert rule for Checkmarx is a quality rule, not a security rule. Quality rules are not relevant for the security review -- you can run the scan to be security rules only if you want.
...
- 3,196
2
votes
Accepted
Endless loop of Chimera scans with failure
The Chimera token was in the correct directory but could not be accessed. As soon as we changed the server settings Chimera ran and ended all its scan runs.
I still think that it is an error on the ...
- 37.2k
2
votes
Accepted
Is there any Lightning Component Code Scanning Tool?
Lightning is "Secure By Design" (almost frustratingly so, in fact). As such, I'm not sure that there would be any demand for a scanner to detect "vulnerabilities." If you could find an actual ...
- 476k
2
votes
FLS Create Error
Problem was related to curly brackets. In security review, it was expected to use curly brackets for each if-else statements; whether it has one line or multiple lines.
2
votes
Accepted
Is fixing "Apex Code Quality" issues necessary for passing security review?
As stated in the documentation, you must fix:
All issues regardless of severity level that aren’t labeled “Code Quality”.
As long as you meet this requirement, you will be fine. Just don't wait too ...
- 476k
1
vote
Accepted
Checkmarx - Bulkify Apex Methods Using Collections In Methods
Two points:
This is probably a coding practice/style warning which is not relevant to a security review (but that is worth addressing to make your code perform better);
Checkmarx never flags all ...
- 33.4k
1
vote
Package review fails with new undocumented issues
Why don't those appear in my own Checkmarx / Security Scanner runs?
Possibly false negatives? It's hard to tell without seeing the code in question and the scanner results; you may need to log a bug ...
- 476k
1
vote
How to run Source Code Scanner / Checkmarx against a Scratch Org?
If you run your scan through the partner security portal, on https://security.secure.force.com/sourcescanner/PackageScannerMain, then you will find that you select package versions, not orgs, for the ...
- 33.4k
1
vote
Accepted
How to remove Salesforce CRUD Delete Security Risk?
Along with isAccessible () Try the below syntax
List myList = [Select Id,Name from myObject__c];
if(myObject__c.sObjectType.getDescribe().isDeletable()){
delete myList;
}
- 114
Only top scored, non community-wiki answers of a minimum length are eligible