Manually Enforce CRUD and FLS in trigger handler and Ajax to pass salesforce security review

Question

I want to pass salesforce security review in my app. I want to make sure that all the known issues fixed before submission. I have Enforced CRUD and FLS in to all the apex classes. But i am not sure about the following points:

1) Is it necessary to Enforce CRUD and FLS on VF page using the AJAX Toolkit:

sforce.connection.query("Select Id, Name From Account",callback);

2) Is it necessary to Enforce CRUD and FLS in trigger handler classes:

Trigger

trigger VAccountTrigger on Account(before update) {

    VAccountTriggerHandler vHandler = new VAccountTriggerHandler();

    if(Trigger.isUpdate && Trigger.isBefore){
        vHandler.beforeUpdate(Trigger.new);
    }
}

Class

public class VAccountTriggerHandler {

    public void beforeUpdate(List<Account> newList) {
    //--------------------------------------------------
    //----Do we need to Enforce CRUD and FLS here too---
    }
}

Answer 1

When rendering VisualForce pages, the platform will automatically enforce CRUD and FLS when the developer references SObjects and SObject fields directly in the VisualForce page. For example, if a user without FLS visibility to the Phone field of the Contact object was to view the below page, phone numbers would be automatically removed from the table.

<apex:page standardController="Account"> 
  <apex:pageBlock title="Contacts"> 
    <apex:dataTable value="{!account.Contacts}" var="contact" cellPadding="4" border="1"> 
      <apex:column> 
        <apex:facet name="header">Name</apex:facet> 
        {!contact.Name} 
      </apex:column> 
      <apex:column> 
        <apex:facet name="header">Phone</apex:facet> 
        {!contact.Phone} 
      </apex:column> 
    </apex:dataTable> 
  </apex:pageBlock> 
</apex:page> 

When we refer fields indirectly then we need to check FLS by our self. For example using wrapper classes or in trigger helper classes.

public with sharing class RandomContactController {
    public String getGetRandomName() {
        // Check if the user has read access on the Contact.Name field
        if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){
          return '';
        }

        Contact [] myList = [SELECT Name FROM Contact LIMIT 1000];
        // Pick a list entry at random
        Integer index = Math.mod(Math.abs(Crypto.getRandomInteger()),myList.size());
        Contact selected = myList.get(index);
        return selected.Name;
    }
}

For more details refer: https://developer.salesforce.com/page/Enforcing_CRUD_and_FLS

Answer 2

For your VAccountTriggerHandler class, yes, you'll need to enforce CRUD/FLS checks (as well as sanitation and other protective measures) manually for security review purposes.

Consider using WITH SECURITY_ENFORCED in your SOQL for a quick catch-all CRUD/FLS fix, or consider .stripInaccessible(), both of which are going GA soon.

See (and do) the Develop Secure Web Apps trail for all the different security measures to account for.