Orsdxy

After running a Checkmarx scan it returned a code quality warning on a method due to Query: Bulkify Apex Methods Using Collections In Methods.

The method is very simple:

    @AuraEnabled

public static String saveDSAM(List<inscor__Data_Service_Account_Mapping__c> dsamList, List<inscor__Customer_Quote__c> cqList) {

    Savepoint sp = database.setSavepoint();

    try {

        if (!Schema.sObjectType.inscor__Data_Service_Account_Mapping__c.isCreateable() ||

                !Schema.sObjectType.inscor__Customer_Quote__c.isUpdateable()) {

                throw new NoAccessException();

        }

        insert dsamList;

        update cqList;

        return 'SUCCESS';

    } catch (Exception ex) {

        Database.rollback(sp);

        system.debug('-Exception-'+ex+'-'+ex.getStackTraceString());

        return 'Error~'+ex.getMessage();

    }

}

It is passed a list of two sObjects and updates, inserts one list and updates another. The line number the scan returns is when the cqList is updated.

Object: cqlist in file: classes/quote360Controller.cls

L 555: public static String saveDSAM(List<inscor__Data_Service_Account_Mapping__c> dsamList, List<inscor__Customer_Quote__c> cqList) {

Object: cqlist in file: classes/quote360Controller.cls

L 563: update cqList;

I thought by modifying the method parameters to be lists that it would resolve this issue. This method is called by a lightning component and is never call in iteration. Any thoughts?

This is almost certainly a false positive, although it may simply be complaining since your code does not explicitly handle the case where dsamList throws an error. I would advise simply ignoring this warning, or possibly reaching out to Checkmarx Support directly to find out why this error would have been generated. The only change I would recommend is to use the appropriate use of AuraHandledException:

@AuraEnabled

public static void saveDSAM(List<inscor__Data_Service_Account_Mapping__c> dsamList, List<inscor__Customer_Quote__c> cqList) {

    try {

        if (!Schema.sObjectType.inscor__Data_Service_Account_Mapping__c.isCreateable() ||

                !Schema.sObjectType.inscor__Customer_Quote__c.isUpdateable()) {

                throw new AuraHandledException('You do not have permission to update these records.');

        }

        insert dsamList;

        update cqList;

    } catch (Exception ex) {

        throw new AuraHandledException('An error occurred: '+ex.getMessage());

    }

}

This removes the need to database.rollback on error, and will enable your code to use proper error handling on the client-side.