0

I had run a security review for my apex code. It returned a number of FLS update error in the result. I have changed/implemented code (see below the code snippet) but the error is still there. Please give me your suggestion if I am following a wrong path.

This is the screenshot of the security review

screenshot of the security review

and the code I have implemented is like this

 if (Schema.sObjectType.Object__c.fields.Id.isAccessible() && sysPol != null)
        obj.id = sysPol;

    if(Object__c.sObjectType.getDescribe().isUpdateable())
        update obj;
1

I think you need to consider all outcomes (if/else) in your code:

if (Schema.sObjectType.Object__c.fields.Id.isAccessible() == false){
 //do nothing
}else{
  if(sysPol != null) obj.id = sysPol;
}

if(Object__c.sObjectType.getDescribe().isUpdateable() ==false){
//do nothing
}else{
  update obj;
}
1

Its also important check isUpdatable() access for fields participating in update operation.

Here are some documents for reference:

  1. Requirements Checklist

  2. Enforcing CRUD and FLS, example from documentation:

    public PageReference updateStatus() {
        // Check if the user has update access on the Contact.Status__c field
        if (!Schema.sObjectType.Contact.fields.Status__c.isUpdateable()){
          // throw custom exception
        }
        c.Status__c = statusToSet;
        update c;
        return null;
      }
    }
    

Would recommend using the Financial force open source library fflib-apex-common by Andrew Facet!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.