3

In preparation to Security Review I am checking that all my classes follow instructions from Sharing in Apex Classes.

Now I am wondering do inner classes also need to be defined as with sharing | without sharing | inherited sharing to pass the security review?

  • 1
    AFAIK, for inner classes its not necessary to specify sharing keyword unless it performs any CRUD operation; which usually we do not perform. Last time we performed a security review, we didn't had a sharing specified on inner classes. – Raul Jul 23 at 13:35
  • @Raul, does it mean that any inner class that does not perform DML or SOQL/SOSL queries can skip sharing declaration at all? – Eduard Jul 23 at 13:50
  • 1
    Not sure how lineant security team is now, no harm in adding sharing keyword as @Adrain suggested on his answer. – Raul Jul 23 at 14:09
4

According to Using the with sharing, without sharing, and inherited sharing Keywords (emphasis mine):

  • Both inner classes and outer classes can be declared as with sharing. The sharing setting applies to all code contained in the class, including initialization code, constructors, and methods.
  • Inner classes do not inherit the sharing setting from their container class.
  • Classes inherit this setting from a parent class when one class extends or implements another.

So yes, you need to declare sharing for each inner class as well.

  • Does it mean that DTO and wrapper classes should be declared with this setting (I assume inherited sharing is the best choice)? – Eduard Jul 24 at 15:14
1

Above all, you need to define sharing mode for inner classes separately, since they are separate classes in terms of inheritance.

you may use inherited sharing since winter 19 to avoid issues

https://releasenotes.docs.salesforce.com/en-us/winter19/release-notes/rn_apex_inherited_sharing.htm

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.