12

I've just gone through a biggish code base making sure that WITH SECURITY_ENFORCED is set on every query. Most were, but for some recent additions, it hadn't been included. For managed packages that need to go through security reviews, this is a great way to respect object and field level security on reads. But tedious to manually check big code bases, especially where dynamic SOQL is used.

  • Does anyone have a PMD Apex Security Rule created for this that they would be happy to share?
  • IMHO it would be great if WITH became the default mode at say API 55 with a WITHOUT SECURITY_ENFORCED option also provided. (Or some other mechanism used to turn WITH on everywhere.)
Improve this question
8
  • 2
    For the latter, make sure you submit an idea on the Idea Exchange. I'm sure @ca_peterson would love to hear it.
    – sfdcfox
    Mar 23, 2021 at 16:34
  • 1
    There is something to be said for making people explicitly type out WITHOUT SECURITY_ENFORCED. It's secure be default unless you type out something that fills people with dread and sets off all sorts of alarm bells. Can you can easily search the code base for instances bypassing security.
    – Daniel Ballinger
    Mar 23, 2021 at 22:38
  • For dynamic SOQL, Reliably detecting SOQL-keywords is an unsolved research problem. Think of all the textual transformations that are possible and what kind of SMT solver you would need to resolve variables at runtime. However you can find many instances with a regular grep. Tools like PMD, which don't have a string solver built in, are not going to do much better than grep in this case. If it is not dynamic soql but an actual keyword, then you can reliably detect it, but I think you would need to write a custom rule for it.
    – Robert Sussland
    Mar 24, 2021 at 1:55
  • 1
    Hi @DanielBallinger, Agree you can search to find missing ones, but would like some approach that detects that on commit as hard to get all developers and reviewers to be perfect.
    – Keith C
    Mar 24, 2021 at 8:03
  • 2
    Right! Doing static analysis on Dynamic SOQL (or Type.forName() ) is equivalent to doing static analysis on eval(). Really it's best to ban dynamic constructions if you want code that is comprehensible to tooling (as well as human reviewers). Having rules in place that force developers to write code that allows for efficient reasoning is the secret to secure coding, and flagging violations of these rules is how you deliver secure code without being able to solve the Halting problem.
    – Robert Sussland
    Mar 24, 2021 at 22:16

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .