Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

I failed to pass security review for an app that has two classes using the "without sharing" keyword. Both were not choosen accidentally but by design.

On class is SObjectUnitOfWork.cls from Andrew Fawcett's Patterns library a well-known and Salesforce.com recommended public library.

The other class was added by myself to access data that is not owned/shared by the user. So I used "without sharing".

How can I pass security review with those cases?

share|improve this question
    
@afawcett: In case you stumble over this..I also added a Github issue here: github.com/financialforcedev/df12-apex-enterprise-patterns/… –  Robert Sösemann Jun 13 at 13:05
2  
By "failed to pass security review" do you mean that the Force.com Security Source Code Scanner flagged the class or do you mean that your app was failed at the end of the Force.com ISV Security Review by a Salesforce person even after you had explained why "without sharing" was correct for your use case? Two very different things. –  Keith C Jun 13 at 13:15

2 Answers 2

up vote 11 down vote accepted

I would strongly suggest reading this recent post by Dan Appleman.

He outlines the various ways in which factors like sharing and CRUD/FLS play into security, and ends with the comment, which tells me you can pass security review with classes not marked as sharing so long that is clear to the users administering the system which uses that construct:

But if you implement one of the architectures described here, it’s virtually guaranteed that your first attempt to pass security review will fail. That’s the bad news. The good news is that the security review team actually understands security – the individuals I’ve dealt with have been consistently very competent. So they understand that real applications often need classes that are defined without sharing, and DML operations that do not test for field accessibility. What they want to see from you is that you aren’t just ignoring security out of laziness, but that those decisions were intentional. They don’t care so much where the security boundary is, as much as that you have one, and that it respects and enforces the configuration on the platform. You’ll need to document exactly what you are doing and why as part of your security review application, but once you’ve done so, assuming your security architecture is sound, you should be able to pass security review, at least with regards to field, object and record level security, without further trouble.

share|improve this answer

You cannot pass security review with classes marked as without sharing, the security scanner will always report these files as being a security violation.

Without Sharing gets flagged by the security scanner because you can write code that disregards the organizations security model with it. It's important to only use without sharing when absolutely necessary, and that's why it always gets blanket flagged as a security violation.

The security scanner is a useful tool for determining security weaknesses in your application, but it should not be treated as if your org is insecure until you have fixed all the issues it points out. As you pointed out, some code will require the without sharing keyword and I have also seen the security scanner report false-positives on other security issues.

share|improve this answer
    
The error was not recognized during Checkmarx scanning it was the real Security Review. If there is a construct like "without sharing" there must be a good reason to sometimes use it. In that case I should be able to use it, don't you agree? –  Robert Sösemann Jun 13 at 13:23
4  
You have to simply explain why you need it. You can pass the security review "without sharing" as long as you can explain coherently why you need it. I've been involved with a project that did need this-- we had to use "without sharing" to sync data correctly. –  sfdcfox Jun 13 at 14:00
    
Thanks for the clarification sfdcfox, I misunderstood and thought the question was talking about the Checkmarx security scanner which will always report without sharing afaik. –  Phil Rymek Jun 13 at 15:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.