12
votes
Accepted
Most optimal way to Enforce CRUD/FLS in Apex
You could write a helper method for this type of functionality:
public Object flsGet(SObject record, SObjectField field)
{
return !field.getDescribe().isAccessible() ? null : record.get(field);
}
...
- 149k
8
votes
Security Review - CRUD/FLS Checks for every SOQL Query
You don't need to check every field that you query. The issue really boils down to who manages security for the field -- your app or the admin. With standard objects, the answer is always the admin. ...
- 3,196
7
votes
Accepted
How do I check CRUD and FLS in apex?
Please refer to this knowledge article.
Basically you just need to add some checks like
if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){
return '';
}
or
if (!Schema....
- 16k
7
votes
Accepted
How to test CRUD and FLS in unit tests?
There are a few different ways to attack this problem, but the most common is to create a user with permissions, and then use System.runAs to execute your tests.
I normally grant permissions to my ...
- 13.1k
6
votes
Accepted
Integration with REST API that is not CRUD
In Salesforce, everything is a CRUD operation. As far as your service is concerned, it needs to support CRUD OData operations. Your application would need to be modified to support CRUD operations. ...
- 481k
6
votes
Accepted
Apex Source Scanner flag CRUD/ FLS as security risk for no reason
To help others who end up here, my response as an answer:
From what you posted, looks like a false positive - so I would document it in review.
Here is a link to a recent update from the SR team ...
- 13.5k
5
votes
CRUD & FLS on Managed Package Objects
Yes the CRUD/FLS are also important on the packaged objects .The decision to assign the permission set or not should be left with the org administrator and not something the package vendor can ...
- 90.4k
5
votes
isAccessible() vs isQueryable() and which one to use for SOQL query CRUD checks
You should use isAccessible() for read check.
isCreateable() to check whether object record is creatable
isUpdateable() to check whether a user can update record.
isDeletable() to check whether a ...
- 3,406
5
votes
Accepted
Dynamically enforce object and field level security?
You might try getting the DescribeSObjectResult directly from the global describe and checking against that:
SObjectType sObjectType = Schema.getGlobalDescribe().get('MyObject__c');
Boolean ...
- 149k
5
votes
Accepted
How to update a field with Lightning Components?
I think the error lies in these lines
var action = component.get("c.account");
action.setParams({ "account": account });
try changing it to
var action = component.get("c.saveAccount");
var account ...
- 2,720
5
votes
Accepted
How to best enforce CRUD/FLS and pass Security Review
The best option today I think is to largely avoid CRUD & FLS and enforce security via custom permissions aligned with your business processes but that is not really answering your question.
Part ...
- 191
5
votes
How to best enforce CRUD/FLS and pass Security Review
The answer was given by Chris Peterson (PM of Apex) and MVP Daniel Ballinger during Dreamforce '19 in the session "Reducing the Cost of Enforcing CRUD and FLS in the ESAPI".
And the answer is: By ...
- 37.3k
4
votes
Accepted
IP Address Restrictions Other Than Profile-Based?
You can't have assign IP restrictions through Permission sets (or) Workflows or any other ways.
For your problem you have to assign a separate profile for the user is only the way.
- 1,439
4
votes
How to best enforce CRUD/FLS and pass Security Review
The most voted advice will get you failed at the security review. End-users rely on CRUD/FLS configurable from UI Setup, and they will get quite surprised that your app does not respect the standard ...
- 189
4
votes
Accepted
Do I need to check FLS for each field when creating a new object record in apex?
In a word: yes.
You should decide if you can categorise the fields as essential or optional (based on both how the field is set as required at the database level, and your app's logic needs) and then ...
- 34.1k
3
votes
Accepted
How to enforce CRUD and FLS in bulk trigger?
Do not throw exceptions in a trigger. This can cause undesirable side effects. You should always use addError in a trigger, and never allow an exception to escape from a trigger. In recent releases, ...
- 481k
3
votes
AppExchange ISV Security Review CRUD/FLS Puzzler
FLS is not automatically enforced just because you used "with sharing." You must check for access to the field before you display it to the user. Typically, if you use apex:inputField or apex:...
- 481k
3
votes
Accepted
Will Sharing=ReadOnly allow my user to Delete or Clone a record
My understanding of ReadOnly is that they would be able to clone if they have IsCreateable permission, but not delete even if they had the CRUD access, because typically, only the owner or someone ...
- 13.5k
3
votes
CRUD and FLS enforcement
So
Yes its of course possible you can do it in two ways (which essentialy are the same)
Schema.sObjectType.Account.isUpdateable()
and
Account.sObjectType.getDescribe().isUpdateable()
if (!Schema....
- 2,275
3
votes
How to check other user's CRUD permission for an object (APEX)
You can try like below
String desireUserId = UserInfo.getUserId(); // or pass any other user id.
User u = [select profileId from user where id =: desireUserId];
String profileId = u.profileId;
List&...
- 900
3
votes
soql on object permissions on a profile
according to Standard Field Record ID Prefix Decoder I found few words about X00 Id prefix:
Found in the PermissionSet Name column where the ProfileId is also
defined. It matches the ProfileId ...
- 18.2k
3
votes
How to test CRUD and FLS in unit tests?
The approach we took was to provide a special class, e.g. SecurityUtils, with a bunch of static methods on it that take the DescribeSObjectResult(s) or DescribeFieldResult(s) to be checked, e.g.:
// ...
- 34.1k
3
votes
How to best enforce CRUD/FLS and pass Security Review
TBH, considering that new security features are on the way but not quite GA yet, maybe your best bet is just to write your own central helper classes that will handle CRUD/FLS to exactly the extent ...
- 10.9k
3
votes
Accepted
Why does the FFLIB framework enforce CRUD security and sharing rules by default for Domains?
I believe the answer is the fflib was originally designed for the ISV world where such checks are desired. By having all your domain classes inherit from an intermediary class, say ApplicationDomain ...
- 69.9k
3
votes
Accepted
CRUD/FLS checks on fields of a lookup
There are often situations where there's a one-off use case where a user persona needs access to data but they shouldn't have blanket access to those objects/fields via OLS/FLS.
When reviewing the ...
- 145
3
votes
Accepted
Do I need to enforce security rules for SOQL in test methods?
You can pass a security review even if the SOQL queries or the dml in test method/setup run in system mode.
Of course you should have valid tests with meaningful assertion, but this is always valid.
...
- 8,247
2
votes
Manually Enforce CRUD and FLS in trigger handler and Ajax to pass salesforce security review
When rendering VisualForce pages, the platform will automatically enforce CRUD and FLS when the developer references SObjects and SObject fields directly in the VisualForce page. For example, if a ...
- 9,110
2
votes
Accepted
Capturing record events without triggers
There are a couple options:
Use an out of the box Syndicated Feed via Site by Adding a Feed to Your Force.com Site.
Roll your own authenticated feed via Visualforce Page using the Streaming API.
The ...
- 149k
2
votes
Security scanner: enforcing CRUD. Auto scanner reported issue
I believe if you think you have the CRUD check in place and you still get the alert, it is better to give a false positive document along with the report to Salesforce while doing a AppExchange ...
- 1,574
2
votes
Accepted
Only top scored, non community-wiki answers of a minimum length are eligible