I received the result from security review from Salesforce team and it failed. One of the vulnerability shown in the report was CRUD/FLS Enforcement. The report suggest I use the isAccessible() check before accessing data.

I have a controller that does look up on Contact, Account, and Task object. I added the isAccessible check before selecting from the object. Here is one of the method from the controller (after I added isAccessible check)

public String getAllContacts(){
    // Check if the user has read access on the Contact fields
    if (!Schema.sObjectType.Contact.fields.id.isAccessible() &&
        !Schema.sObjectType.Contact.fields.phone.isAccessible() &&
        !Schema.sObjectType.Contact.fields.firstname.isAccessible() &&
      return '';

    allContactList = [SELECT id, phone, firstname, lastname FROM Contact LIMIT 200];
    return JSON.serialize(allContactList);        

After adding the check, my code coverage went down to 63%. And I think it is because of the if statement.

How can I include the check for isAccessible in my test class to increase my code coverage?

Here is my test class:

public class SoftphoneSearchController_test {
    public static testMethod void validateSoftphoneController() {            
        SoftphoneSearchController objSoftphone = new SoftphoneSearchController();
        list<SoftphoneSearchController> SoftList = new list<SoftphoneSearchController>();
        String name = 'Jon';
        objSoftPhone.contactName = 'Snow';
        objSoftPhone.accountName = 'United';

        list<Contact> ct=new list<Contact>();
        list<Account> Ac=new list<Account>();
        list<task> T=new list<task>();
        list<task> Ta=new list<task>();

        //insert SoftList;
        System.assert(SoftList.size() > 0);



Currently my code coverage is at 63%. Please advise how can I increase my code coverage.

I have looked at

These article doesn't have what I am looking for.

Thank you

1 Answer 1


You need to have 2 profiles, one with accessible to all those fields and other will not have access to those fields.

Now, create users based on those profiles and run the testmethods with System.runAs(user)

public static testMethod void testRunAs() {
      // Setup test data
      // This code runs as the system user
      Profile p = [SELECT Id FROM Profile WHERE Name='Standard User']; 
      User u = new User(Alias = 'standt', Email='[email protected]', 
      EmailEncodingKey='UTF-8', LastName='Testing', LanguageLocaleKey='en_US', 
      LocaleSidKey='en_US', ProfileId = p.Id, 
      TimeZoneSidKey='America/Los_Angeles', UserName='[email protected]');

      System.runAs(u) {
         // The following code runs as user 'u' 
         System.debug('Current User: ' + UserInfo.getUserName());
         System.debug('Current Profile: ' + UserInfo.getProfileId()); 
  • I'm in a similar situation as OP, this is an AppExchange app I'm submitting for review, would this mean I would have to bundle a custom profile with my deployment, specifically for testing something that end users should never have? Is there a way I can create the profile just in the test context. I just want to unit test my CRUD/FLS code :(
    – Mattisdada
    Sep 29, 2020 at 23:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .