Lightning components don’t automatically enforce CRUD and FLS when you reference objects or retrieve the objects from an Apex controller. This means that the framework continues to display records and fields for which users don’t have CRUD access and FLS visibility.
So all security checks must always be performed server-side). You must explicitly check for for isAccessible(), isUpdateable(), isCreateable(), isDeletable() prior to performing these operations on sObjects.
Here is the example
public with sharing class ExpenseController {
@AuraEnabled
public static List<cObject__c> get_UNSAFE_Expenses() { //vulnerable
return [SELECT Id, ClientId__c,Client_Secret__c FROM cObject__c];
}
@AuraEnabled
public static List<cObject__c> getExpenses() { //safe
//check for encrypted permission
boolean hasEncryptData = userHasEncryptedData(UserInfo.getUserId());
@AuraEnabled
public static Account getEncryptedField(String recId){
Map<String,Schema.SObjectField> m = Schema.SObjectType.cObject__c.fields.getMap();
// API Names for describes are returned in all lowercase
Set<String> cObjectFieldsToRetrieve = new Set<String>{'id', 'ClietId__c','ClietSecret__c'};
cObject__c objC = [SELECT Id,ClietId__c,ClietSecret__c
FROM cObject__c
WHERE Id = :recId];
// Iterate over describe results
for(String val : m.keySet()){
// Check that it is in fields that are cared about
if(m.get(val).getDescribe().isAccessible() && cObjectFieldsToRetrieve.contains(val)){
// Check if it is an encrypted string and if so, sanitize
// else return the original value
if(m.get(val).getDescribe().getType().name() == 'ENCRYPTEDSTRING'){
objC.put(val, sanitizeEncryptedData(hasEncryptData, (String)objC.get(val)));
} else {
objC.put(val, (String)objC.get(val));
}
}
}
return objC;
}
/***********************************************************
* Description: Return if user has View Encrypted Data permission.
*
* @param: userId - userId to check if has encrypted data permission
*
* @return: boolean
* ********************************************************/
public static boolean userHasEncryptedData(Id userId){
List<PermissionSetAssignment> psaEncrypt = [SELECT Id
FROM PermissionSetAssignment
WHERE PermissionSet.PermissionsViewEncryptedData = true
AND AssigneeId = :userId];
if(psaEncrypt.isEmpty()){
return false;
} else{
return true;
}
}
/***********************************************************
* Description: Sanitize the string if the user does not have view encrypted data permission.
*
* @param: hasEncryptedData - if the user has encrypted data permission
* @param: stringToSanitize - the string to santitize before returning to client
* @param: fieldType - this is the type of field to sanitize, only perform if encrypted string
*
* @return: boolean
* ********************************************************/
public static String sanitizeEncryptedData(boolean hasEncryptedData, String stringToSanitize){
if(!hasEncryptedData && stringToSanitize != null){
String mask = 'X';
return mask.repeat(stringToSanitize.length());
} else{
return stringToSanitize;
}
}
}
Referece:
Lightning Security
CRUD and Field-Level Security (FLS)
Methods
