What are Aura: Aysnc Code and Sharing Violation vulnerabilities from the security review of the application(AppExchange)

Question

I was creating an application to publish in app exchange and so I had submitted the application for security review but the report cointained:-

We have completed the security review of your application. Unfortunately, we have found some issues which concern us, and thus, at this time we cannot approve your application for final listing. Trust and security are core values at Salesforce, and we are committed to working with you to resolve those issues. The following vulnerabilities need to be resolved: Aura: Aysnc Code And Sharing Violation. Upon further investigation I found out that I missed the 'with sharing ' in one of my apex class and also that apex class is used in the scheduler class. Is this the reason I am getting Aura: Aysnc Code security vulnerability?

Answer 1

Without seeing the full details, I'm not 100% certain, but it sounds like you have a class which starts off as:

public class MyAuraController {

Or:

public without sharing class MyAuraController {

You need to change it to meet the security requirements:

public inherited sharing MyAuraController {

Or

public with sharing class MyAuraController {

You can read more about these keywords in the documentation.

In addition, you must use Security.stripInaccessible or use the appropriate sObjectField describe calls to ensure that fields and records are actually allowed to be viewed/edited by the user (as appropriate).