Skip to main content
12 votes
Accepted

Most optimal way to Enforce CRUD/FLS in Apex

You could write a helper method for this type of functionality: public Object flsGet(SObject record, SObjectField field) { return !field.getDescribe().isAccessible() ? null : record.get(field); } ...
Adrian Larson's user avatar
  • 151k
8 votes

Security Review - CRUD/FLS Checks for every SOQL Query

You don't need to check every field that you query. The issue really boils down to who manages security for the field -- your app or the admin. With standard objects, the answer is always the admin. ...
Robert Sussland's user avatar
7 votes
Accepted

How to test CRUD and FLS in unit tests?

There are a few different ways to attack this problem, but the most common is to create a user with permissions, and then use System.runAs to execute your tests. I normally grant permissions to my ...
Sebastian Kessel's user avatar
6 votes
Accepted

Integration with REST API that is not CRUD

In Salesforce, everything is a CRUD operation. As far as your service is concerned, it needs to support CRUD OData operations. Your application would need to be modified to support CRUD operations. ...
sfdcfox's user avatar
  • 497k
6 votes
Accepted

Apex Source Scanner flag CRUD/ FLS as security risk for no reason

To help others who end up here, my response as an answer: From what you posted, looks like a false positive - so I would document it in review. Here is a link to a recent update from the SR team ...
BritishBoyinDC's user avatar
5 votes

CRUD & FLS on Managed Package Objects

Yes the CRUD/FLS are also important on the packaged objects .The decision to assign the permission set or not should be left with the org administrator and not something the package vendor can ...
Mohith Shrivastava's user avatar
5 votes

isAccessible() vs isQueryable() and which one to use for SOQL query CRUD checks

You should use isAccessible() for read check. isCreateable() to check whether object record is creatable isUpdateable() to check whether a user can update record. isDeletable() to check whether a ...
Manjot Singh's user avatar
  • 3,526
5 votes
Accepted

Dynamically enforce object and field level security?

You might try getting the DescribeSObjectResult directly from the global describe and checking against that: SObjectType sObjectType = Schema.getGlobalDescribe().get('MyObject__c'); Boolean ...
Adrian Larson's user avatar
  • 151k
5 votes
Accepted

How to best enforce CRUD/FLS and pass Security Review

The best option today I think is to largely avoid CRUD & FLS and enforce security via custom permissions aligned with your business processes but that is not really answering your question. Part ...
Kevin Jones's user avatar
5 votes

How to best enforce CRUD/FLS and pass Security Review

The answer was given by Chris Peterson (PM of Apex) and MVP Daniel Ballinger during Dreamforce '19 in the session "Reducing the Cost of Enforcing CRUD and FLS in the ESAPI". And the answer is: By ...
Robert Sösemann's user avatar
4 votes
Accepted

IP Address Restrictions Other Than Profile-Based?

You can't have assign IP restrictions through Permission sets (or) Workflows or any other ways. For your problem you have to assign a separate profile for the user is only the way.
Pavan tej's user avatar
  • 1,458
4 votes

How to best enforce CRUD/FLS and pass Security Review

The most voted advice will get you failed at the security review. End-users rely on CRUD/FLS configurable from UI Setup, and they will get quite surprised that your app does not respect the standard ...
touzoku's user avatar
  • 189
4 votes
Accepted

Do I need to check FLS for each field when creating a new object record in apex?

In a word: yes. You should decide if you can categorise the fields as essential or optional (based on both how the field is set as required at the database level, and your app's logic needs) and then ...
Phil W's user avatar
  • 37k
3 votes

soql on object permissions on a profile

according to Standard Field Record ID Prefix Decoder I found few words about X00 Id prefix: Found in the PermissionSet Name column where the ProfileId is also defined. It matches the ProfileId ...
Oleksandr Berehovskyi's user avatar
3 votes

How to check other user's CRUD permission for an object (APEX)

You can try like below String desireUserId = UserInfo.getUserId(); // or pass any other user id. User u = [select profileId from user where id =: desireUserId]; String profileId = u.profileId; List&...
Radhe Radhe's user avatar
3 votes
Accepted

Will Sharing=ReadOnly allow my user to Delete or Clone a record

My understanding of ReadOnly is that they would be able to clone if they have IsCreateable permission, but not delete even if they had the CRUD access, because typically, only the owner or someone ...
BritishBoyinDC's user avatar
3 votes
Accepted

How to enforce CRUD and FLS in bulk trigger?

Do not throw exceptions in a trigger. This can cause undesirable side effects. You should always use addError in a trigger, and never allow an exception to escape from a trigger. In recent releases, ...
sfdcfox's user avatar
  • 497k
3 votes

AppExchange ISV Security Review CRUD/FLS Puzzler

FLS is not automatically enforced just because you used "with sharing." You must check for access to the field before you display it to the user. Typically, if you use apex:inputField or apex:...
sfdcfox's user avatar
  • 497k
3 votes

CRUD and FLS enforcement

So Yes its of course possible you can do it in two ways (which essentialy are the same) Schema.sObjectType.Account.isUpdateable() and Account.sObjectType.getDescribe().isUpdateable() if (!Schema....
user1974566's user avatar
  • 2,325
3 votes

How to test CRUD and FLS in unit tests?

The approach we took was to provide a special class, e.g. SecurityUtils, with a bunch of static methods on it that take the DescribeSObjectResult(s) or DescribeFieldResult(s) to be checked, e.g.: // ...
Phil W's user avatar
  • 37k
3 votes

How to best enforce CRUD/FLS and pass Security Review

TBH, considering that new security features are on the way but not quite GA yet, maybe your best bet is just to write your own central helper classes that will handle CRUD/FLS to exactly the extent ...
Charles T's user avatar
  • 11k
3 votes
Accepted

Why does the FFLIB framework enforce CRUD security and sharing rules by default for Domains?

I believe the answer is the fflib was originally designed for the ISV world where such checks are desired. By having all your domain classes inherit from an intermediary class, say ApplicationDomain ...
cropredy's user avatar
  • 72.1k
3 votes
Accepted

CRUD/FLS checks on fields of a lookup

There are often situations where there's a one-off use case where a user persona needs access to data but they shouldn't have blanket access to those objects/fields via OLS/FLS. When reviewing the ...
Dan Wuensch's user avatar
3 votes
Accepted

Do I need to enforce security rules for SOQL in test methods?

You can pass a security review even if the SOQL queries or the dml in test method/setup run in system mode. Of course you should have valid tests with meaningful assertion, but this is always valid. ...
RubenDG's user avatar
  • 8,752
2 votes

Security scanner: enforcing CRUD. Auto scanner reported issue

I believe if you think you have the CRUD check in place and you still get the alert, it is better to give a false positive document along with the report to Salesforce while doing a AppExchange ...
Vignesh Damodharan's user avatar
2 votes
Accepted

FLS Create for upsert

You need to check both isCreateable() and isUpdateable() for upsert.
Reshma's user avatar
  • 4,039
2 votes
Accepted

Enforcing CRUD / FLS / Sharing in Apex

With the help of Eric I am going to try to answer my question by myself: CRUD and FLS is part of metadata, so information about (custom) objects in general. With the Schema Class one should determine ...
fat32's user avatar
  • 228
2 votes

Manually Enforce CRUD and FLS in trigger handler and Ajax to pass salesforce security review

When rendering VisualForce pages, the platform will automatically enforce CRUD and FLS when the developer references SObjects and SObject fields directly in the VisualForce page. For example, if a ...
AtulRajguru9's user avatar
  • 9,120
2 votes
Accepted

CRUD/FLS Enforcement: how to add isAccessible() to the test class for code coverage

You need to have 2 profiles, one with accessible to all those fields and other will not have access to those fields. Now, create users based on those profiles and run the testmethods with System....
Santanu Boral's user avatar
2 votes
Accepted

Enforce CRUD for Database.delete

This issue is false positive. The scanner rule is not getting it. However, you should change the logic to:- if((EMPYRAMDM__UploadedContact_Csv_Dup__c.sObjectType.getDescribe().isDeletable())) { ...
Ashwani's user avatar
  • 22.6k

Only top scored, non community-wiki answers of a minimum length are eligible