I'm passing the Data Leak Prevention module and have faced some misunderstanding here in this unit


public with sharing class CRUD_FLS_Challenge {

    public List<Treasures__c> treasures {get;set;}
    public String chestContents {get;set;}

    public CRUD_FLS_Challenge()
        treasures = new List<Treasures__c>([select Name, Type__c, Found__c, Description__c, Castle__r.Name FROM Treasures__c where Found__c =: True limit 5]);  

VF markup:

<apex:page controller="CRUD_FLS_Challenge" tabStyle="CRUD_FLS_Challenge__tab">
    <apex:pageBlockTable value="{!treasures}" var="p">
                <apex:column headervalue="Name">
                    <apex:OutputText value="{!p.Name}" /> <!-- p.Name is vulnerable NO -->
                <apex:column headervalue="Description">
                    <apex:OutputText value="{!p.Description__c}" /> <!-- p.Description__c is vulnerable NO -->

why {!treasures} aren't vulnerable?


The Visualforce page has built-in measures to respect the CRUD/FLS settings of the logged-in user.

As the trailhead unit describes:

This table displays the object fields using standard object notation--{!p.Name}, {!p.Description__c}, {!p.Found__c}, {!p.Castle__r.Name}--so by default the platform enforces any CRUD and FLS restrictions. This is why, just as we expected, the sensitive fields are not displayed.

  • Am I right or not thinking about it this way: page controller runs under system context and if it without sharing - no matter about sharings. But if it with sharing then for example inside controler I can access all fields and when some SQOL results are transmitting to VF (or lightnig component) receiver checks OWD/FLS? Case with some "wrapper" will be insecure?
    – pincet
    Jan 5 '20 at 11:34
  • 1
    Exactly (at least the way I understand it) - VF pages have built-in security measures for FLS. The with sharing is only telling you what records actually show up to the user, but the SOQL will still get field data even if FLS says they shouldn't see certain fields. See the recent release of WITH SECURITY_ENFORCED to enforce FLS, or using .stripInaccessible() Jan 5 '20 at 12:58
  • 1
    P.S. A very nice a long discussion on with sharing, without sharing, OWDs, etc within the forms here Jan 5 '20 at 13:01
  • 1
    VF gets the records from the controller (which are based on the sharing settings) and then decides which fields can be shown on a field-by-field basis based on FLS settings for the logged-in user. I think the VF page framework is acting as that "third" entity, and I vaguely remember the term MVVC (with two Vs), implying it doesn't follow a true-to-core MVC model Jan 5 '20 at 14:14
  • 1
    Thanks a lot, really. Your quote "I think the VF page framework is acting as that "third" entity" was the one I expected
    – pincet
    Jan 5 '20 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.