Who knows the answer to this puzzler?
Q: If a Visualforce Page is using a standard controller with a custom controller extension and the controller extension is declared "with sharing", do we need to do manual CRUD/FLS enforcement in the custom controller for non-DML data access?
Background:
Our app was not approved for final listing because a CRUD/FLS Enforcement vulnerability was indicated. In this case, the flagged code is in a custom controller extension that is extending a standard controller extension and is declared "with sharing". Obviously, it's easy enough to go in and add additional CRUD/FLS checks (per https://developer.salesforce.com/page/Enforcing_CRUD_and_FLS). But I want to make sure I fully understand the security architecture.
In the flagged case, we are not performing DML operations on the field. It is only for selecting a value for informational display. I was under the impression that if a custom controller extension is extending a standard controller and is declared "with sharing" then it executes in user mode, in which the permissions, field-level security, and sharing rules of the current user apply. (See the note at the bottom of https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_controller_extension.htm)
Wouldn't the controller extensions documentation imply that we don't need to do additional CRUD/FLS checks in the controller extension if we aren't performing DML? Certainly there are reasons to do the checks for graceful degradation of functionality and such. But is it actually a security risk if we aren't doing the additional checks?
Thanks, Philip
