I know this sounds like a standard question, so please bear with me.
Recently our Security Reviews fail due to CRUD/FLS violations. The highlighted codelines include almost every SOQL Query in the application.
Our approach is usually as follows:
- In case of displaying data on VF pages we either use sObjects fields or use the platform methods to check the accessibility of the fields
- In case of domain logic triggered by the user (e.g. by clicking a button on a VF page) we have a helper class that checks every field to be updated before doing the DML operation.
Up until recently this approach has worked fine (and passed pervious Security Reviews). As mentioned above the latest Security Review results seem to require us to check every field in a SOQL query for accessibility even if it is never displayed back to the user.
Let's suppose the following program flow as an example:
- Query an object with some fields
- Perform some modification on said fields
- Perform an update on the sObject to save the modification using a helper class which checks for the required CUD/FLS rights for the modified fields
As I see it there is no need for checking field accessibility in step 1 in that case (since nothing is displayed back to the user and the dml operation is already protected). Is that correct or am I missing something?
So is it really required to do an accessibility check for every SOQL Query in the code?
Another question would be how to handle background operations in that case like data purging. These have either to be running in system mode (which causes issues during the Security Review) or require the job to be started by a user with the appropriate access rights (which can be error prone and is not that user friendly). Is there any best practice regarding that.
Unfortunately I could not find a question targeting exactly that issue. Most of the questions I have found are related to how to perform that check (like this or that). So please apologize in case the question was already answered (I would really appreciate a link to the answer then).
Thanks for your time and help.