In my managed package I have a custom RestResource that looks something like this (simplified):

global class setCustomSettings {
        CustomSetting__c newCustomSetting;
        String sResponse = RestContext.request.requestBody.toString();
        Map<String, Object> m = (Map<String, Object>)JSON.deserializeUntyped(sResponse);   

        String orgId = [Select Id from Organization][0].Id;

        newCustomSetting.custom_key__c = (String)m.get('custom_key__c');
        newCustomSetting.custom_client__c = (String)m.get('custom_client__c');
        newCustomSetting.SetupOwnerId = String.escapeSingleQuotes(orgId);

        update newCustomSetting;
        RestContext.response.responseBody = Blob.valueOf('{"Success":"true"}');

This is getting flagged in the Checkmarx scan as an "FLS" vulnerability. Is that because I need to somehow check for permissions before I update this record? I was relying on the fact that this call is being made with the admin user's OAuth token and thats the only way the request would be allowed so therefore they should have permission. What am I missing?

2 Answers 2


Well your assumption about call will be always made by Admin user is not 100% correct. In fact any user can oAuth. So from salesforce standpoint it may happen that user have permission for oauth but no permissions on fields. so to fix this you will need to check in apex

To check the field-level update permission of the contact's email field before updating it:

if (Schema.sObjectType.Contact.fields.Email.isUpdateable()) {
   // Update contact phone number

To check the field-level create permission of the contact's email field before creating a new contact:

if (Schema.sObjectType.Contact.fields.Email.isCreateable()) {
   // Create new contact

To check the field-level read permission of the contact's email field before querying for this field:

if (Schema.sObjectType.Contact.fields.Email.isAccessible()) {
   Contact c = [SELECT Email FROM Contact WHERE Id= :Id];

To check the object-level permission for the contact before deleting the contact. view sourceprint?

if (Schema.sObjectType.Contact.isDeletable()) {
   // Delete contact
  • Did you mean 100% incorrect?
    – Eric
    Commented Jul 22, 2016 at 4:08
  • 1
    I mean not 100% correct. Thank you for pointing that out. just updated my answer. Commented Jul 22, 2016 at 4:20

Well i faced a similar issue. I was figuring out what went wring with the security review. And I stumbled across ESAPI. It amazing appexchange product that handles all that complex field level security checks for you.


Its free/opensource and maintained by salesforce. You can check its examples here. https://github.com/forcedotcom/force-dot-com-esapi

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .