4

I've recently had an app fail the security review due to lack of CRUD/FLS checks on dynamic/static SOQL. These queries against CronTrigger were some of the things flagged:

24 Integer count = [SELECT COUNT() FROM CronTrigger WHERE CronJobDetail.Name = :cronName]; 67 CronTrigger ct = [SELECT Id FROM CronTrigger WHERE CronJobDetail.Name = :cronName];

It doesn't appear that there is a way to set CRUD/FLS on CronTrigger. Is that right? Is there another way to verify access? Could this be a false positive? (I had a meeting with the security team - they didn't note whether it was false or not at that time).

  • Hi Dan, You have to add the line for the fields you are using in your query for accessibility check like this: if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){ return ''; // Your Code or query here. } Please reference this Link: developer.salesforce.com/page/Enforcing_CRUD_and_FLS – Ajay Dubedi Jun 1 '16 at 8:04
  • @AjayDubedi - I've been using that method with other objects for a while. It didn't work for CronTrigger (although I don't remember the specific issues I had). – Dan Bough Jun 1 '16 at 17:30
0

You can do CRUD/FLS checks in triggers just like you do them in classes. I think there is some confusion between the sharing keyword, which controls individual record access, and CRUD/FLS, which is about access to the datatype. Triggers cannot be declared 'with sharing' (you'll get a syntax error if you try), but triggers can and should contain the appropriate isAccessible checks needed to comply with your organization's security policy.

Here is some simple example code, if you have an object called foo__c, with field myField__c in namespace myns:

trigger permTest on myns__foo__c (before update) {
    Boolean allowAccess = myns__foo__c.myns__myField__c.getDescribe().isUpdateable();

    for (myns__foo__c foo : Trigger.new) {
        if (allowAccess) {
                foo.myns__myField__c = 'You don\'t have permission to change this field';
            } else {
                foo.myns__myField__c = 'You do have permission to change this field';
            }
    }
}

You can try creating a user that has sharing access to a specific record and edit access to the object, myns__foo__c, but not edit access to the custom field myns__myField__c. Then try to modify an object in this user context and verify that the field says you don't have permission to modify it!

This confirms that 1) like all classes, triggers run in system mode, and therefore can modify everything and 2) you can use the same CRUD/FLS checks with objects and fields like everywhere else to ensure that the organization's policies are enforced.

Whether your app needs to respect the organization's security policies doesn't depend on how you implement your code. If you refactor your code to use triggers or batch apex, that doesn't lift the obligation to respect the current security settings. However you are touching data, make sure that you are not overriding any settings made by the org admin. All Apex code has an associated user context -- this includes things like scheduled jobs, batch apex and triggers -- you can use the getDescribe() calls to obtain datatype access policies for the associated user context in all of these cases.

|improve this answer|||||
  • The code is querying CronTrigger directly. How would an admin set permissions on CronTrigger or any of its fields? – Dan Bough Oct 10 '16 at 12:46
  • The code is querying the field permission. The admin sets permission on the field, not on the the trigger. The trigger code needs to respect the admin's permissions on the field. – Robert Sussland Oct 10 '16 at 12:48
  • How would you set permissions on CronJobDetail.Name or CronTrigger.Id? – Dan Bough Oct 10 '16 at 12:50
  • You must be looking at some different code. myns__foo__c.myns__myField__c.getDescribe().isUpdateable() checks for permissions on myns__foo__c.myns__myField__c. – Robert Sussland Oct 10 '16 at 12:53
  • Ahh. when you said "the code" in reply to my answer, you meant OP code. :) I gave an example of how to check for CRUD/FLS in triggers. – Robert Sussland Oct 10 '16 at 12:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.