Contents
Do you have to enforce CRUD and FLS in apex?
ISVs that wish to get their app listed on the AppExchange must pass a security review. It has now become mandatory for developers to code their application to honor the CRUD and FLS constraints of the currently running user on both reads and writes. The burden that this imposes upon an Apex code base is unreasonable.
Is there a checkmarx vulnerability in Salesforce apex?
As such this is a Checkmarx false positive and must be addressed by explaining the scenario in your submission documentation. This answer covers how you can also best to comment the relevant code to help the Salesforce Security Team navigate the report from Checkmarx.
How to respond to false positives in checkmarx scan results?
The following example shows how to document your responses to false positives resulting from a Checkmarx scan. The example is in tabular format, but you can use whatever format suits the reporting of your information. We implemented and called the AuthManager class to check these paths for us or throw an error.
Do you need to check security in apex class?
In an apex class you should check Field Level Security. Most of us do not check. This is best practice to explicitly check security before any database statement like SELECT, INSERT, UPDATE AND DELETE. If you create an app to for AppeExchange then it is must for your app.
How to enforce object level permissions in apex?
To enforce object-level and field-level permissions, use the WITH SECURITY_ENFORCED clause for SOQL SELECT queries in Apex code, including subqueries and cross-object relationships.
When to use with security _ enforced clause in apex controller?
The WITH SECURITY_ENFORCED clause is ideal if you have minimal experience developing secure code and for applications that don’t require graceful degradation on permissions errors. This example queries fields on a custom expense object with an insecure method, get_UNSAFE_Expenses ().
When to specify with sharing in apex controller?
When you declare a class, it’s a best practice to specify with sharing to enforce sharing rules when a component uses the Apex controller. An @AuraEnabled Apex class that doesn’t explicitly set with sharing or without sharing, or is defined with inherited sharing, uses a default or implicit value of with sharing.