16

I failed to pass security review for an app that has two classes using the "without sharing" keyword. Both were not choosen accidentally but by design.

On class is SObjectUnitOfWork.cls from Andrew Fawcett's Patterns library a well-known and Salesforce.com recommended public library.

The other class was added by myself to access data that is not owned/shared by the user. So I used "without sharing".

How can I pass security review with those cases?

17

I would strongly suggest reading this recent post by Dan Appleman.

He outlines the various ways in which factors like sharing and CRUD/FLS play into security, and ends with the comment, which tells me you can pass security review with classes not marked as sharing so long that is clear to the users administering the system which uses that construct:

But if you implement one of the architectures described here, it’s virtually guaranteed that your first attempt to pass security review will fail. That’s the bad news. The good news is that the security review team actually understands security – the individuals I’ve dealt with have been consistently very competent. So they understand that real applications often need classes that are defined without sharing, and DML operations that do not test for field accessibility. What they want to see from you is that you aren’t just ignoring security out of laziness, but that those decisions were intentional. They don’t care so much where the security boundary is, as much as that you have one, and that it respects and enforces the configuration on the platform. You’ll need to document exactly what you are doing and why as part of your security review application, but once you’ve done so, assuming your security architecture is sound, you should be able to pass security review, at least with regards to field, object and record level security, without further trouble.

6

You cannot pass security review with classes marked as without sharing, the security scanner will always report these files as being a security violation.

Without Sharing gets flagged by the security scanner because you can write code that disregards the organizations security model with it. It's important to only use without sharing when absolutely necessary, and that's why it always gets blanket flagged as a security violation.

The security scanner is a useful tool for determining security weaknesses in your application, but it should not be treated as if your org is insecure until you have fixed all the issues it points out. As you pointed out, some code will require the without sharing keyword and I have also seen the security scanner report false-positives on other security issues.

  • The error was not recognized during Checkmarx scanning it was the real Security Review. If there is a construct like "without sharing" there must be a good reason to sometimes use it. In that case I should be able to use it, don't you agree? – Robert Sösemann Jun 13 '14 at 13:23
  • 6
    You have to simply explain why you need it. You can pass the security review "without sharing" as long as you can explain coherently why you need it. I've been involved with a project that did need this-- we had to use "without sharing" to sync data correctly. – sfdcfox Jun 13 '14 at 14:00
  • Thanks for the clarification sfdcfox, I misunderstood and thought the question was talking about the Checkmarx security scanner which will always report without sharing afaik. – Phil Rymek Jun 13 '14 at 15:10
6

In order to pass the security review, every controller or controller extension must have 'with sharing'. There are no exceptions to this.

However, if you need to perform some privileged action (and there is a valid business reason for this), then you can make a helper class with an explicit 'without sharing' declaration, and call the helper class from your controller. The helper class should be limited in its functionality to only performing the necessary privileged operations.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.