Dml
apex-csrf-constructor
apex-csrf-constructor
Having DML operations in Apex class constructor or initializers can have unexpected side effects: By just accessing a page, the DML statements would be executed and the database would be modified. Just querying the database is permitted.
Likelihood: MEDIUM
Confidence: HIGH
CWE:
- CWE-352: Cross-Site Request Forgery (CSRF)
OWASP:
- A01:2021 - Broken Access Control
apex-csrf-static-constructor
apex-csrf-static-constructor
Having DML operations in Apex class constructor or initializers can have unexpected side effects: By just accessing a page, the DML statements would be executed and the database would be modified. Just querying the database is permitted.
Likelihood: MEDIUM
Confidence: HIGH
CWE:
- CWE-352: Cross-Site Request Forgery (CSRF)
OWASP:
- A01:2021 - Broken Access Control
dml-native-statements
dml-native-statements
Native Salesforce DML operations execute in system context, ignoring the current user’s permissions, field-level security, organization-wide defaults, position in the role hierarchy, and sharing rules. Be mindful when using native Salesforce DML operations.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-863: Incorrect Authorization
OWASP:
- A01:2021 - Broken Access Control
- A04:2021 - Insecure Design