13

I believe I have heard a specific term for this pattern, but I am not able to retrieve it from the foggy banks of my memory:

public with sharing class OuterClass
{
    public without sharing class InnerClass { }
}

What term describes InnerClass above? How about the pattern in general?

  • 4
    I've used the pattern before (I could even tell you what class it's currently in within our org), but I don't think I've heard of a name for it. The technical term for being "without sharing" is being in "system mode," (with the other term being "user mode"), but that doesn't describe the pattern. – sfdcfox Feb 21 '16 at 0:53
  • @AdrianLarson, do you think this pattern merits a term of its own and if so, against which background? – tobibeer Feb 25 '16 at 12:43
  • 1
    I've used this pattern to create a "Data Accessor". The only functionality provided by that inner class is to run DML operations or SOQL for the outer class. The inner class would usually be private. – frontendloader Feb 25 '16 at 15:40
  • 1
    After thinking about it, I'd say: If done unintentionally, I'd call this a privilege escalation bug, otherwise it would be an elevated privileges pattern (to borrow some terms from other IT sectors). The former implies that the user can do something they shouldn't be able to normally, while the latter implies that the user is specifically granted the ability to do something they can't normally do. Not sure if this is what you're looking for, though. – sfdcfox Feb 25 '16 at 20:19
7

I believe the term you're looking for is Trampoline because it allows a developer to "Bounce" up into a higher security context. Trampolines should be written very carefully and validate their parameters and be well documented in place as to the why such behavior is needed.

It is important to note that a trampoline will only ever bypass sharing and not field level security. This is because Field Level security is already not enforced in apex.

9
+50

When this pattern is done unintentionally, it's a "privilege escalation bug," which is a major security concern. This design pattern will at least raise red flags with the security review team if this pattern is used in a package, and will also be flagged by the Cloud Security scanner. It's usually better to configure the system to allow users to do things with normal permissions.

However, sometimes you need to do this, to allow things to be done that the user can't normally do. For example, maybe you need to allow users to merge contacts, but not outright delete contacts. By removing the Delete Contact permission, you can still give them controlled access to merge contacts by getting around the security model. When done intentionally, I'd want to call this an elevated privileges pattern, which suggests that you're intentionally elevating their privileges just for a single transaction.

  • 1
    This term describes the pattern well, but not as much the inner class itself. Perhaps privilege scaffold, privilege escalator, or some such? – Adrian Larson Feb 26 '16 at 22:11
1

I've used this pattern to create a "Data Accessor". The only functionality provided by that inner class is to run DML operations or SOQL for the outer class. The inner class would usually be private.

  • 1
    I like this term, but it seems to imply read-only, whereas the fact that it alters DML operations in addition to SOQL indicates the term needs to encompass read-write. – Adrian Larson Feb 26 '16 at 17:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.