Skip to main content
8 votes
Accepted

Why Is Checkmarx Taking So Long To Complete?

From my personal experience as an ISV employee, I can say that this is pretty normal during the weeks leading up to a release. Here's the problem: ISVs are given about a month before the release hits ...
sfdcfox's user avatar
  • 495k
8 votes
Accepted

Strange error is showing when trying to open partner security portal with primary partner community user

After I opened a Salesforce support case, I was told to open the following link https://login.salesforce.com/services/auth/sso/00D30000000JsbiEAC/Chimera?site=https://security.secure.force.com/chimera ...
Patlatus's user avatar
  • 17.2k
6 votes
Accepted

How can I mitigate URL redirection attacks?

You're allowing the attacker to use any arbitrary input, so they can inject extra parameters, etc. I think what the security scanner is looking for is EncodingUtil.urlEncode: String url = '/' + ...
sfdcfox's user avatar
  • 495k
5 votes
Accepted

Does assert methods needed in @testSetup?

No, you don't need to include Asserts in @TestSetup methods. You could make a note of the fact that this is such a method in your False Positives document that should accompany the security scan ...
Simon Lawrence's user avatar
5 votes
Accepted

How to submit to the security scanner in a developer org?

The question here is about running the Security Scanner (NOT on how to conduct a Security Review for AppExchange apps). To do so, all you need to ensure is that your code resides in a loose form (not ...
Gaurav Kheterpal's user avatar
5 votes

Checkmarx Force.com Security Source Scanner - any way to mark known false-positives?

You really only have two choices: fix the code so it no longer generates the false positive, or live with it. The first almost always results in suboptimal code changes, such as purposefully calling ...
sfdcfox's user avatar
  • 495k
4 votes
Accepted

SOQL inside a While loop is not detected in Security review

Neither PMD nor the Code Scanner consider this pattern to be a code violation for "SOQL inside a loop." That type of rule is more concerned with code that is not bulkified (e.g. using multiple queries ...
sfdcfox's user avatar
  • 495k
4 votes
Accepted

Security scanner working procedure?

I had a call with CheckMarx customer care. He mentioned that if the submitted org is in queue then it is not yet scanned. So on the time of scanning whatever code available in the org will be ...
DOMINIC EDWARD's user avatar
4 votes
Accepted

Security review failed due to debug lines

Record IDs are not keys. PII are things like names, email addresses, phone numbers, and so on. Technically a User ID isn't PII, nor are they keys. However, I feel like you're focused in the wrong ...
sfdcfox's user avatar
  • 495k
3 votes

Using SOQL Injection to delete data

SOQL and SQL are distant cousins. Unlike SQL, you cannot have multiple statements in SOQL, can't execute arbitrary Apex, and you can't even perform DML statements of any kind. As such, the absolutely ...
sfdcfox's user avatar
  • 495k
3 votes
Accepted

Using SOQL Injection to delete data

Apex compiler will error out as you cannot provide apex statement as string and then expect compiler to compile automatically.
Mohith Shrivastava's user avatar
3 votes

How to solve Reflected XSS error in query referenced in my Visualforce Component

Lets first understand what is XSS and see what are the possible ways to prevent this Cross-site scripting(XSS) is a vulnerability that occurs when an attacker can insert unauthorized JavaScript, ...
Amit Singh's user avatar
3 votes

"Client Cross Frame Scripting Attack" by Checkmarx Scanner for Visualforce component

This looks like a false positive. There are false positives with every query, of course, and we regularly review these queries. Going forward, we are going to remove this query from our security ...
Robert Sussland's user avatar
3 votes
Accepted

Security scanner not giving updates

Does it normally take this long? It really does depend on volume. Especially shortly before and after a release, you can expect a wait time of up to a few weeks (the longest I've seen is about 14 ...
sfdcfox's user avatar
  • 495k
3 votes
Accepted

Salesforce code analyzer DFA

Am I doing something wrong here? Not that I can tell. For a security review I need to submit clean reports / document false positives is this a false positive? Presumably, yes. Also, you should see ...
sfdcfox's user avatar
  • 495k
2 votes

Does assert methods needed in @testSetup?

The missing assert rule for Checkmarx is a quality rule, not a security rule. Quality rules are not relevant for the security review -- you can run the scan to be security rules only if you want. ...
Robert Sussland's user avatar
2 votes
Accepted

FLS Create for upsert

You need to check both isCreateable() and isUpdateable() for upsert.
Reshma's user avatar
  • 4,039
2 votes
Accepted

How to use the security scanner when you need your code in a package?

It doesn't scan code in installed packages. It scans just the code that is native to the org. There's no problem with just pointing the scanner at your existing org.
sfdcfox's user avatar
  • 495k
2 votes

How to submit to the security scanner in a developer org?

Up till now, i have got done some security reviews, out of which all of them were developed in developer orgs. As per Salesforce, Package should be developed in developer org and its must if its ...
Ishwar Mete's user avatar
  • 1,492
2 votes
Accepted

Endless loop of Chimera scans with failure

The Chimera token was in the correct directory but could not be accessed. As soon as we changed the server settings Chimera ran and ended all its scan runs. I still think that it is an error on the ...
Robert Sösemann's user avatar
2 votes
Accepted

Is there any Lightning Component Code Scanning Tool?

Lightning is "Secure By Design" (almost frustratingly so, in fact). As such, I'm not sure that there would be any demand for a scanner to detect "vulnerabilities." If you could find an actual ...
sfdcfox's user avatar
  • 495k
2 votes

FLS Create Error

Problem was related to curly brackets. In security review, it was expected to use curly brackets for each if-else statements; whether it has one line or multiple lines.
Bernard Black the Second's user avatar
2 votes
Accepted

Is fixing "Apex Code Quality" issues necessary for passing security review?

As stated in the documentation, you must fix: All issues regardless of severity level that aren’t labeled “Code Quality”. As long as you meet this requirement, you will be fine. Just don't wait too ...
sfdcfox's user avatar
  • 495k
2 votes

Best (commercial) Scanner to stay prepared for Security Review

Did you consider trying out Snyk? It launched Apex support back in October but I haven't done a deep-dive yet. I didn't see it in your list, so I thought it would be worth mentioning. https://snyk.io/...
nicolas's user avatar
  • 234
1 vote

How to detect Formula Expressions exposing vulnerable information like session id?

That's not a vulnerability, simply an example of how formulas can be used. Later in the paragraph, they state that if you allow editable, unescaped values into your code, you can introduce ...
sfdcfox's user avatar
  • 495k
1 vote
Accepted

Checkmarx - Bulkify Apex Methods Using Collections In Methods

Two points: This is probably a coding practice/style warning which is not relevant to a security review (but that is worth addressing to make your code perform better); Checkmarx never flags all ...
Phil W's user avatar
  • 36.8k
1 vote

Package review fails with new undocumented issues

Why don't those appear in my own Checkmarx / Security Scanner runs? Possibly false negatives? It's hard to tell without seeing the code in question and the scanner results; you may need to log a bug ...
sfdcfox's user avatar
  • 495k
1 vote

How to run Source Code Scanner / Checkmarx against a Scratch Org?

If you run your scan through the partner security portal, on https://security.secure.force.com/sourcescanner/PackageScannerMain, then you will find that you select package versions, not orgs, for the ...
Phil W's user avatar
  • 36.8k
1 vote
Accepted

How to remove Salesforce CRUD Delete Security Risk?

Along with isAccessible () Try the below syntax List myList = [Select Id,Name from myObject__c]; if(myObject__c.sObjectType.getDescribe().isDeletable()){ delete myList; }
Sunil Reddy's user avatar
1 vote
Accepted

check FLS and CRUD for more than one field

You can get a list of all createable fields through this way: public static Set<String> getCreateableFields(Schema.SObjectType objectType) { Set<String> createableFields = new Set<...
Mr.Frodo's user avatar
  • 5,802

Only top scored, non community-wiki answers of a minimum length are eligible