Security review for a managed package with Polymorphic SOQL queries

Question

I checked the documentation "Enable Field- and Object-Level Permissions Checking Using WITH SECURITY_ENFORCED in SOQL Queries". But looks like the below query won't work because traversing a polymorphic field’s relationship is not supported in queries using WITH SECURITY_ENFORCED.

SELECT Id, WhatId, WhoId FROM Task 
WHERE WhoId IN :idSet 
AND What.Type = 'Request__c' 

Now we need to use the similar kind of query like above in a managed package. How can I make sure that the security review is completed? Do I need to use stripInaccessible method?

UPDATE: This query needs to be executed in without sharing context.

Answer 1

You can either use StripInaccessible or a describe API to make sure you check for FLS.

There is a neat blog post that you can adopt some code from.

My preference would be to use the StripInaccessible as it consumes less CPU compared to the describe callouts.

If you need further assistance, I suggest book an office hour with the security review team at Salesforce

Answer 2

Snl,

There are different topics here.

1. WITH SECURITY_ENFORCED. This a good keyword to use, but it is not required that you use it for the security review.

2. Security Review of internal apps. The issue with the review is that you avoid SOQL Injection and that your app performs secure access control logic. Good access control means that you respect the organization's security policy for objects that you do not own. There are no exceptions to this. But for fields that you do own, that is, custom fields, you have an opportunity to describe your business logic when you go through the review, and then that is what you need to enforce in your apex code.

3. For security review of external apps, that is, experience or VF sites, you often must override standard policies and run without sharing as many of these fields' access policies are off by default and it would be a risk to enable them for external users.

When it comes to access control enforcement there are a number of tools to help you if you just want to respect the organization's policies. For example, with sharing, stripInaccessible, and SECURITY_ENFORCED are tools to help you. When you deviate from that path because you have more complex business logic to enforce on your custom fields, then you are allowed to do that but the app is put under more scrutiny and you are on your own to roll your own access control logic, which is generally discouraged but occasionally required. Please only do this if you are an expert. However you should still be able to pass the review with custom logic. If you want more detailed assistance, then book an office hour to go over this.