Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this community
I failed to pass security review for an app that has two classes using the "without sharing" keyword. Both were not choosen accidentally but by design.
On class is SObjectUnitOfWork.cls from Andrew Fawcett's Patterns library a well-known and Salesforce.com recommended public library.
The other class was added by myself to access data that is not owned/shared by the user. So I used "without sharing".
How can I pass security review with those cases?
I would strongly suggest reading this recent post by Dan Appleman.
He outlines the various ways in which factors like sharing and CRUD/FLS play into security, and ends with the comment, which tells me you can pass security review with classes not marked as sharing so long that is clear to the users administering the system which uses that construct:
But if you implement one of the architectures described here, it’s virtually guaranteed that your first attempt to pass security review will fail. That’s the bad news. The good news is that the security review team actually understands security – the individuals I’ve dealt with have been consistently very competent. So they understand that real applications often need classes that are defined without sharing, and DML operations that do not test for field accessibility. What they want to see from you is that you aren’t just ignoring security out of laziness, but that those decisions were intentional. They don’t care so much where the security boundary is, as much as that you have one, and that it respects and enforces the configuration on the platform. You’ll need to document exactly what you are doing and why as part of your security review application, but once you’ve done so, assuming your security architecture is sound, you should be able to pass security review, at least with regards to field, object and record level security, without further trouble.
You cannot pass security review with classes marked as without sharing, the security scanner will always report these files as being a security violation.
Without Sharing gets flagged by the security scanner because you can write code that disregards the organizations security model with it. It's important to only use without sharing when absolutely necessary, and that's why it always gets blanket flagged as a security violation.
The security scanner is a useful tool for determining security weaknesses in your application, but it should not be treated as if your org is insecure until you have fixed all the issues it points out. As you pointed out, some code will require the without sharing keyword and I have also seen the security scanner report false-positives on other security issues.
without sharing afaik.
Jun 13, 2014 at 15:10
In order to pass the security review, every controller or controller extension must have 'with sharing'. There are no exceptions to this.
However, if you need to perform some privileged action (and there is a valid business reason for this), then you can make a helper class with an explicit 'without sharing' declaration, and call the helper class from your controller. The helper class should be limited in its functionality to only performing the necessary privileged operations.
