2

Who knows the answer to this puzzler?

Q: If a Visualforce Page is using a standard controller with a custom controller extension and the controller extension is declared "with sharing", do we need to do manual CRUD/FLS enforcement in the custom controller for non-DML data access?

Background:

Our app was not approved for final listing because a CRUD/FLS Enforcement vulnerability was indicated. In this case, the flagged code is in a custom controller extension that is extending a standard controller extension and is declared "with sharing". Obviously, it's easy enough to go in and add additional CRUD/FLS checks (per https://developer.salesforce.com/page/Enforcing_CRUD_and_FLS). But I want to make sure I fully understand the security architecture.

In the flagged case, we are not performing DML operations on the field. It is only for selecting a value for informational display. I was under the impression that if a custom controller extension is extending a standard controller and is declared "with sharing" then it executes in user mode, in which the permissions, field-level security, and sharing rules of the current user apply. (See the note at the bottom of https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_controller_extension.htm)

Wouldn't the controller extensions documentation imply that we don't need to do additional CRUD/FLS checks in the controller extension if we aren't performing DML? Certainly there are reasons to do the checks for graceful degradation of functionality and such. But is it actually a security risk if we aren't doing the additional checks?

Thanks, Philip

  • "Sharing" equates to "can the current user see this record via the sharing model", this doesn't have any bearing on whether the user can perform CRUD on the object in question or fields on this object. That security mechanism is separate from sharing and must be enforced by your code in custom pages & apex. It also applies to lightning components too. – Mark Pond Sep 14 '17 at 1:32
  • Thanks, @MarkPond. Perhaps "With Sharing" was a red herring I included for completeness. From: developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/… "However, if a controller extension extends a standard controller, the logic from the standard controller does not execute in system mode. Instead, it executes in user mode, in which the permissions, field-level security, and sharing rules of the current user apply." This is why I believe we don't need to do CRUD/FLS checks in the controller extension if we aren't performing DML. Thoughts? – Philip F Sep 14 '17 at 16:27
3

FLS is not automatically enforced just because you used "with sharing." You must check for access to the field before you display it to the user. Typically, if you use apex:inputField or apex:outputField, Visualforce will "protect" you from casually displaying data that should not be shown, but if you use other types of elements, like apex:outputText, you must verify this on your own.

  • Thanks, @sfdcfox. Perhaps "With Sharing" was a red herring I included for completeness. From: developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/… "However, if a controller extension extends a standard controller, the logic from the standard controller does not execute in system mode. Instead, it executes in user mode, in which the permissions, field-level security, and sharing rules of the current user apply." This is why I believe we don't need to do CRUD/FLS checks in the controller extension if we aren't performing DML. Thoughts? – Philip F Sep 14 '17 at 16:31
  • @PhilipFaulconer I believe it's suggesting that if you use StandardController.save, field level security will be enforced. However, anything you do in the extension doesn't gain that same benefit. Any fields you set or read in your extension should check for FLS first. – sfdcfox Sep 14 '17 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.