How to fix an FLS security vulnerability?

Question

In my managed package I have a custom RestResource that looks something like this (simplified):

@RestResource(urlMapping='/customsettings')
global class setCustomSettings {
        CustomSetting__c newCustomSetting;
        String sResponse = RestContext.request.requestBody.toString();
        Map<String, Object> m = (Map<String, Object>)JSON.deserializeUntyped(sResponse);   

        String orgId = [Select Id from Organization][0].Id;

        newCustomSetting.custom_key__c = (String)m.get('custom_key__c');
        newCustomSetting.custom_client__c = (String)m.get('custom_client__c');
        newCustomSetting.SetupOwnerId = String.escapeSingleQuotes(orgId);

        update newCustomSetting;
        RestContext.response.responseBody = Blob.valueOf('{"Success":"true"}');
}

This is getting flagged in the Checkmarx scan as an "FLS" vulnerability. Is that because I need to somehow check for permissions before I update this record? I was relying on the fact that this call is being made with the admin user's OAuth token and thats the only way the request would be allowed so therefore they should have permission. What am I missing?

Answer 1

Well your assumption about call will be always made by Admin user is not 100% correct. In fact any user can oAuth. So from salesforce standpoint it may happen that user have permission for oauth but no permissions on fields. so to fix this you will need to check in apex

To check the field-level update permission of the contact's email field before updating it:

if (Schema.sObjectType.Contact.fields.Email.isUpdateable()) {
   // Update contact phone number
}

To check the field-level create permission of the contact's email field before creating a new contact:

if (Schema.sObjectType.Contact.fields.Email.isCreateable()) {
   // Create new contact
}

To check the field-level read permission of the contact's email field before querying for this field:

if (Schema.sObjectType.Contact.fields.Email.isAccessible()) {
   Contact c = [SELECT Email FROM Contact WHERE Id= :Id];
}

To check the object-level permission for the contact before deleting the contact. view sourceprint?

if (Schema.sObjectType.Contact.isDeletable()) {
   // Delete contact
}

Answer 2

Well i faced a similar issue. I was figuring out what went wring with the security review. And I stumbled across ESAPI. It amazing appexchange product that handles all that complex field level security checks for you.

https://appexchange.salesforce.com/listingDetail?listingId=a0N30000009x7hPEAQ

Its free/opensource and maintained by salesforce. You can check its examples here. https://github.com/forcedotcom/force-dot-com-esapi