1

I checked the documentation "Enable Field- and Object-Level Permissions Checking Using WITH SECURITY_ENFORCED in SOQL Queries". But looks like the below query won't work because traversing a polymorphic field’s relationship is not supported in queries using WITH SECURITY_ENFORCED.

SELECT Id, WhatId, WhoId FROM Task 
WHERE WhoId IN :idSet 
AND What.Type = 'Request__c' 

Now we need to use the similar kind of query like above in a managed package. How can I make sure that the security review is completed? Do I need to use stripInaccessible method?

UPDATE: This query needs to be executed in without sharing context.

2 Answers 2

3

You can either use StripInaccessible or a describe API to make sure you check for FLS.

There is a neat blog post that you can adopt some code from.

My preference would be to use the StripInaccessible as it consumes less CPU compared to the describe callouts.

If you need further assistance, I suggest book an office hour with the security review team at Salesforce

4
  • I stripped off all other fields of Task object to make it smaller. Also this query is going to be a dynamic query, for which I will be using Database.query() method.
    – nica
    May 26, 2021 at 20:59
  • @snl You can use stripInaccessible. It works with dynamic queries too. May 26, 2021 at 21:05
  • This is bad advice, Mohith. It does not matter what field you are returning, but rather what fields are being queried. Consider the following query: SELECT Id FROM Account WHERE AnnualRevenue > 100000. This query may only return an Id, but it is leaking information about revenue, which is sensitive. In fact you can pull all data out of the object even if the query returns only an Id. May 28, 2021 at 3:46
  • @Robert Thanks for correction! I will update this answer! I always assumed if you do not need FLS check but makes ssnss May 28, 2021 at 3:49
0

Snl,

There are different topics here.

  1. WITH SECURITY_ENFORCED. This a good keyword to use, but it is not required that you use it for the security review.

  2. Security Review of internal apps. The issue with the review is that you avoid SOQL Injection and that your app performs secure access control logic. Good access control means that you respect the organization's security policy for objects that you do not own. There are no exceptions to this. But for fields that you do own, that is, custom fields, you have an opportunity to describe your business logic when you go through the review, and then that is what you need to enforce in your apex code.

  1. For security review of external apps, that is, experience or VF sites, you often must override standard policies and run without sharing as many of these fields' access policies are off by default and it would be a risk to enable them for external users.

When it comes to access control enforcement there are a number of tools to help you if you just want to respect the organization's policies. For example, with sharing, stripInaccessible, and SECURITY_ENFORCED are tools to help you. When you deviate from that path because you have more complex business logic to enforce on your custom fields, then you are allowed to do that but the app is put under more scrutiny and you are on your own to roll your own access control logic, which is generally discouraged but occasionally required. Please only do this if you are an expert. However you should still be able to pass the review with custom logic. If you want more detailed assistance, then book an office hour to go over this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .