0

From the Salesforce security review point of view for the the app exchange app, we need to add the access checks while querying and doing DML operations. If we have a requirement that the SOQL/DML needs to be done irrespective of the user's permissions, then we can use the without sharing class.

But let's say we have an inherited class, whose running mode will be defined by the calling class. In this case, how we can correctly add the access checks for SOQL/DML? The class will run in the system mode or user mode depending upon the calling class and we don't want to add the access checks when it is getting called from the class that is marked as without sharing. Is there any methods to identify the class running mode?

Or we don't need to add the access checks when we marked the class as inherited class? Can we add the false/positive for the same?

3
  • What do you mean by the access checks? Are you referring to FLS? Or record sharing?
    – Nick C
    Jul 22, 2022 at 7:08
  • 1
    Does this answer your question? Does with sharing enforce OLS/FLS?
    – Nick C
    Jul 22, 2022 at 7:40
  • @NickCook I am referring to the Field level and object level access. The shared link doesn't answer my question. Jul 22, 2022 at 11:40

1 Answer 1

2

Sharing is orthogonal to SOQL/DML permissions and should not be conflated with it.

Sharing controls visibility and write access to individual records while permissions control visibility and write access for whole objects and their fields.

All apex, other than Anonymous Apex, implicitly runs in system mode. To apply user mode requirements against SOQL and DML is up to the developer to apply appropriate checks or use appropriate features (e.g. schema checks, stripInaccessible and USER_MODE etc.).

Permission checks must always be applied, for both queries and DML iterations, regardless of Sharing.

For sharing, you can check UserRecordAccess for individual records if desired, either as a standalone query (where CRUD permissions are also considered) or as a related record within the queried objects (where only sharing is considered).

If your code must bypass permission checks you must declare a CRUD/FLS false positive. See this other Q&A for more.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .