What is salesforce security?
The Salesforce Security model assists you in protecting information at various levels, from an org level down to a personal record. The Organization, Objects, Records, and Fields are the logical tiers of security. While using the model allows users to safeguard the organization’s information at four layers.
We will cover how to enforce data security and how to prevent SOQL injection attacks in Apex. We’ll also review what Locker Service does for you and security best practices for LWC. We will also cover some security in Salesforce interview questions for the apex.
Why does salesforce security need in your code?
The Salesforce Security Features Developed by a Salesforce Application Development Company Can Assist You in Empowering Your Users To Do Their Jobs Safely And Efficiently. Salesforce Limits The Exposure Of Data To The Users.
User Mode vs System Mode
System mode means running apex code by ignoring the user’s permissions. like Apex Classes, Apex Triggers, and Apex Services.
User mode means running apex code by respecting the user’s permissions and sharing of records. Let’s understand it in more detail.
List of Component for applying salesforce security in below
- Apex class Security
- Application Security
- Lightning Web Component Security
- Visualforce page Security
Security in apex class
Enforcing Object & FLS Permissions in Apex
Apex doesn’t enforce object-level and field-level permissions by default. Let’s see how we can enforce the CRUD & FLS in Apex.
|
Read data (SOQL) |
Modify data (DML) |
| Schema methods |
Yes |
Yes |
| WITH SECURITY_ENFORCED |
Yes |
No |
| Security.stripInaccessible() |
Yes |
Yes |
| Database operations in user mode (pilot) |
Yes |
Yes |
Schema Methods
You can also enforce object-level and field-level permissions in your code by explicitly calling the sObject to describe result methods.
CRUD
You can call the isAccessible, isCreateable, or isUpdateable methods of Schema.DescribeSObject -Result to verify whether the current user has read, create, or update access to an sObject.
- Schema.sObjectType.Account.isAccessible() – before querying
For example :
- Schema.sObjectType.Account.isCreateable() – before inserting
For example :
- Schema.sObjectType.Account.isUpdateable() – before updating
For example :
- Schema.sObjectType.Account.isDeletable() – before deleting
For example :
Field Level Security
You can use the below method to check field-level security before querying.
- Schema.sObjectType.Contact.fields.Status__c.isAccessible()
- Schema.sObjectType.Contact.fields.Status__c.isCreateable()
- Schema.sObjectType.Contact.fields.Status__c.isUpdateable()
For example:
WITH SECURITY_ENFORCED
Use the WITH SECURITY_ENFORCED clause to enable field- and object-level security permissions checking for SOQL SELECT queries in Apex code.
It Checks for both CURF & FLS.
For example:
Security.stripInaccessible()
Use the stripInaccessible method to enforce field- and object-level data protection. This method can be used to strip the fields and relationship fields from query and subquery results that the user can’t access. The method can also be used to remove inaccessible sObject fields before DML operations to avoid exceptions and to sanitize sObjects that have been deserialized from an untrusted source
The Id field is never stripped
SObjectAccessDecision securityDecision = Security.stripInaccessible(AccessType, sourceRecords);
Contact ctc = securityDecision.getRecords()[0]; System.debug(CTC.isSet(‘social_security_number__c’)); // prints “false”
User mode database operations (Pilot)
CRUD, FLS and sharing New parameter on:
- Database.query methods
- Search.query methods
- Database DML methods (insert, update, upsert, delete)
Apex generally runs in system context meaning current user’s permissions and field-level security take place during code execution. Our Apex code should not expose the sensitive data to the User which is hidden via security and sharing settings. Hence, Apex security and enforcing the sharing rule is most important. Let’s see how we can enforce the sharing in Apex.
Not related to CRUD or FLS!!!!
|
Sharing Enforced |
| With sharing |
Yes |
| Without sharing |
No |
| Inherited sharing |
Inherit from parent, with sharing if entry point |
| No sharing clause |
Inherited from parent,
Without sharing if entry point except for lightning |
With Sharing Keyword
If you use this keyword, then the Apex code will enforce the Sharing settings of the current user to Apex code. This does not enforce the Profile permission, only the data level sharing settings.
For example:
Without Sharing Keyword
Class declared with this keyword executes in System mode.
For example :
Enforcing the current user’s sharing rules can impact:
- SOQL and SOSL queries. A query may return fewer rows than it would operate in system context.
- DML operations. An operation may fail because the current user doesn’t have the correct permissions
Bulkify Apex Code
The very first principle is to write code for more than one record at a time. We should write scalable code and avoid hitting the governor. Let’s understand with an example. In the code below we are using a hard Coded Index[0]. Means code will only work on single record
Solution
In the above Trigger, the code explicitly accesses only the first record in the trigger.new collection by using the syntax Trigger.New[0]. Instead, the trigger should properly handle the entire collection of Accounts using Trigger.new collection.
For example :
Trigger AccountTrigger on Account(before insert){
for(Account acc: trigger.New){
if(acc.Name != null){
// DO something
}
}
}
Avoid SOQL & DML inside for Loop
Do not place SOQL or DML(insert/update/delete/undelete) statements inside a loop. When these operations are placed inside a for loop, database operations are invoked once per iteration of the loop making it very easy.
For example:
Map<Id, Account> accountMap=new Map<id, Account>([select id,name, (select id from contacts) from account where id in:trigger.newmap.keyset()]);
for(Account acc: accountMap.values()){
for(Contact con:acc.Contacts){
}
}
Use of the Limits Apex Methods
Use Apex Limits Methods to Avoid Hitting SF Governor Limits. Many of us are facing governor limit errors in trigger/classes/test classes. Few of the governor limit errors as follow:-
- Too many SOQL queries: 101
- Dml rows 10001
- Too many query rows 50001.
For example:
Now, using the above Limit methods we can check how many SOQL queries we can issue in the current Apex Context
If(Limits.getLimitQueries() – Limits.getQueries()>0) {
// Execute SOQL Query here.
}
Exception Handling in Apex Code
DML statements return run-time exceptions if something went wrong in the database during the execution of the DML operations. Don’t forget to use Try catch blocks for exception handling. With Apex, you can write code that responds to specific exceptions.
For example:
System.runAs()
Only for Test Mode
Enforces sharing, not CRUD or FLS
For example:
@isTest
private class TestRunAs {
public static testMethod void testRunAs() {
// Setup test data
// Create a unique UserName
String uniqueUserName = ‘standarduser’ + DateTime.now().getTime() + ‘@testorg.com’;
// This code runs as the system user
Profile p = [SELECT Id FROM Profile WHERE Name=’Standard User’];
User u = new User(
Alias = ‘standt’,
Email=’standarduser@testorg.com’,
EmailEncodingKey=’UTF-8′,
LastName=’Testing’,
LanguageLocaleKey=’en_US’,
LocaleSidKey=’en_US’,
ProfileId = p.Id,
TimeZoneSidKey=’America/Los_Angeles’,
UserName=uniqueUserName
);
System.runAs(u) {
// The following code runs as user ‘u’
System.debug(‘Current User: ‘ + UserInfo.getUserName());
System.debug(‘Current Profile: ‘ + UserInfo.getProfileId());
}
}
Application Security
When queries are built directly with user data inlined or query text, instead of using type-safe bind parameters, malicious input may be able to change the structure of the query to bypass or change application logic. This is called a SOQL injection attack.
Preventing SOQL Injection
There is the following way available in Salesforce to prevent SOQL Injections.
- Use static queries
- If need to use dynamic queries, always bind user input with “:”
- If not possible, escape typecast or whitelist inputs
Using static SOQL:
Account[] accts = [SELECT Name, Phone FROM Account];
If need to use dynamic queries, always bind user input with “:”
public static List getAccount(String searchValue) {
String likeValue = ‘%’ + searchValue + ‘%’;
return (List) Database.query(
‘SELECT Name FROM Account WHERE Name LIKE :likeValue’
);
}
Escape Single Quotes / Typecasting
If not possible, escape typecast or whitelist inputs
Escape Single Quotes:
Typecasting like below:
- Reflected XSS → app echoes malicious script from user input
- Stored XSS → app returns malicious script from database
- DOM XSS → reflected XSS but just on the browser
Locker Service
- JavaScript Strict mode enforcement
- DOM access containment → Safe Harbour: mechanism to relax this restriction
- Secure wrappers → sfdc.co/locker-api-viewer
- CSP → sfdc.co/locker-csp
Security in LWC
LWC Base Components enforce CRUD, FLS, and Sharing
- lightning-record-form
- lightning-record-edit-form
- Lightning-record-view-form
LDS Wire adapters and functions enforce CRUD, FLS, and Sharing If calling Apex → apply the techniques just seen!
Enable Lightning web security in your Org.
- From Setup, in the Quick Find box, enter Session, and then select Session Settings.
- On the Session Settings page, select Use Lightning Web Security for Lightning web components and save.
- Clear your browser cache after enabling or disabling Lightning Web Security to ensure the correct files are loaded in the browser. If you suspect that the correct security architecture is not in effect.
Load Assets Correctly
To import a third-party JavaScript or CSS library, use the platformResourceLoader module.
- Download the JavaScript or CSS files from the third-party library’s site.
- Upload the library to your Salesforce organization as a static resource, which is a Lightning security requirement.
- In a component’s JavaScript file:
- Import the static resource.
import myResourceName from ‘@salesforce/resourceUrl/myResourceName’;
import { loadStyle, loadScript } from ‘lightning/platformResourceLoader’;
Using the Lightning Platform resource loader guarantees your scripts always load in the correct order, are not duplicated, and load only when all dependencies have already loaded.
If the Lightning Platform resource loader is not used, it is possible that you or your customers may encounter page-breaking bugs as a result of a duplicated or improperly loaded script.
Visualforce page security
When does the Platform stop respecting FLS?
When you assign from a sObject to a primitive!
Apex:
Random_Sensitive_Object_1__c r;
wRandom_Sensitive_Object_1 wR;
wR.Sensitive_Number = r.Sensitive_Number__c;
Visualforce:
We showed you how to respect FLS read permissions in Apex. Which one of the following would allow you to respect the FLS read permission in Visualforce?
Solution:
- Rendered=”{!$ObjectType.CustomObject__c.fields.CustomField__c.isAccessible}”
- Rendered=”{!$ObjectType.CustomObject__c.CustomField__c.isAccessible()}”
- Rendered=”{!$ObjectType.CustomObject__c.fields.CustomField__c.Accessible}”
- Rendered=”{!$ObjectType.CustomObject__c.CustomField__c}”
As the folder has been created, we can see different files and folder which has been created through extensions.
You can use the below code.
