5

In my managed package I have a custom RestResource that looks something like this (simplified):

@RestResource(urlMapping='/customsettings')
global class setCustomSettings {
        CustomSetting__c newCustomSetting;
        String sResponse = RestContext.request.requestBody.toString();
        Map<String, Object> m = (Map<String, Object>)JSON.deserializeUntyped(sResponse);   

        String orgId = [Select Id from Organization][0].Id;

        newCustomSetting.custom_key__c = (String)m.get('custom_key__c');
        newCustomSetting.custom_client__c = (String)m.get('custom_client__c');
        newCustomSetting.SetupOwnerId = String.escapeSingleQuotes(orgId);

        update newCustomSetting;
        RestContext.response.responseBody = Blob.valueOf('{"Success":"true"}');
}

This is getting flagged in the Checkmarx scan as an "FLS" vulnerability. Is that because I need to somehow check for permissions before I update this record? I was relying on the fact that this call is being made with the admin user's OAuth token and thats the only way the request would be allowed so therefore they should have permission. What am I missing?

6

Well your assumption about call will be always made by Admin user is not 100% correct. In fact any user can oAuth. So from salesforce standpoint it may happen that user have permission for oauth but no permissions on fields. so to fix this you will need to check in apex

To check the field-level update permission of the contact's email field before updating it:

if (Schema.sObjectType.Contact.fields.Email.isUpdateable()) {
   // Update contact phone number
}

To check the field-level create permission of the contact's email field before creating a new contact:

if (Schema.sObjectType.Contact.fields.Email.isCreateable()) {
   // Create new contact
}

To check the field-level read permission of the contact's email field before querying for this field:

if (Schema.sObjectType.Contact.fields.Email.isAccessible()) {
   Contact c = [SELECT Email FROM Contact WHERE Id= :Id];
}

To check the object-level permission for the contact before deleting the contact. view sourceprint?

if (Schema.sObjectType.Contact.isDeletable()) {
   // Delete contact
}
| improve this answer | |
  • Did you mean 100% incorrect? – Eric Jul 22 '16 at 4:08
  • 1
    I mean not 100% correct. Thank you for pointing that out. just updated my answer. – AtulRajguru9 Jul 22 '16 at 4:20
0

Well i faced a similar issue. I was figuring out what went wring with the security review. And I stumbled across ESAPI. It amazing appexchange product that handles all that complex field level security checks for you.

https://appexchange.salesforce.com/listingDetail?listingId=a0N30000009x7hPEAQ

Its free/opensource and maintained by salesforce. You can check its examples here. https://github.com/forcedotcom/force-dot-com-esapi

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.