DF19: Reducing the cost of enforcing FLS & CRUD in the ESAPI

"Reducing the cost of enforcing FLS & CRUD in the ESAPI" session from Dreamforce '19, presented by Chris Peterson and Daniel Ballinger

https://success.salesforce.com/apex/m_Sessions?eventId=a1Q3A000021ea1UUAQ#/session/a2q3A000002BJNlQAO

ESAPI On GitHub
- https://sfdc.co/apex-esapi

Security.stripInaccessible developer docs
- https://sfdc.co/apex-strip-doc

Transcript

1. Daniel Ballinger, Senior Developer (FuseIT) chris.peterson@salesforce.com, @ca_peterson Chris Peterson, Director of Product Management fishofprey.com, @fishofprey Reducing the cost of enforcing FLS & CRUD in the ESAPI
2. Forward-Looking Statement This presentation contains forward-looking statements about the company’s financial and operating results, which may include expected GAAP and non-GAAP financial and other operating and non-operating results, including revenue, net income, diluted earnings per share, operating cash flow growth, operating margin improvement, expected revenue growth, expected current remaining performance obligation growth, expected tax rates, the one-time accounting non-cash charge that was incurred in connection with the Salesforce.org combination; stock-based compensation expenses, amortization of purchased intangibles, shares outstanding, market growth and sustainability goals. The achievement or success of the matters covered by such forward-looking statements involves risks, uncertainties and assumptions. If any such risks or uncertainties materialize or if any of the assumptions prove incorrect, the company’s results could differ materially from the results expressed or implied by the forward-looking statements we make. The risks and uncertainties referred to above include -- but are not limited to -- risks associated with the effect of general economic and market conditions; the impact of geopolitical events; the impact of foreign currency exchange rate and interest rate fluctuations on our results; our business strategy and our plan to build our business, including our strategy to be the leading provider of enterprise cloud computing applications and platforms; the pace of change and innovation in enterprise cloud computing services; the seasonal nature of our sales cycles; the competitive nature of the market in which we participate; our international expansion strategy; the demands on our personnel and infrastructure resulting from significant growth in our customer base and operations, including as a result of acquisitions; our service performance and security, including the resources and costs required to avoid unanticipated downtime and prevent, detect and remediate potential security breaches; the expenses associated with new data centers and third-party infrastructure providers; additional data center capacity; real estate and office facilities space; our operating results and cash flows; new services and product features, including any efforts to expand our services beyond the CRM market; our strategy of acquiring or making investments in complementary businesses, joint ventures, services, technologies and intellectual property rights; the performance and fair value of our investments in complementary businesses through our strategic investment portfolio; our ability to realize the benefits from strategic partnerships, joint ventures and investments; the impact of future gains or losses from our strategic investment portfolio, including gains or losses from overall market conditions that may affect the publicly traded companies within the company's strategic investment portfolio; our ability to execute our business plans; our ability to successfully integrate acquired businesses and technologies, including delays related to the integration of Tableau due to regulatory review by the United Kingdom Competition and Markets Authority; our ability to continue to grow unearned revenue and remaining performance obligation; our ability to protect our intellectual property rights; our ability to develop our brands; our reliance on third-party hardware, software and platform providers; our dependency on the development and maintenance of the infrastructure of the Internet; the effect of evolving domestic and foreign government regulations, including those related to the provision of services on the Internet, those related to accessing the Internet, and those addressing data privacy, cross-border data transfers and import and export controls; the valuation of our deferred tax assets and the release of related valuation allowances; the potential availability of additional tax assets in the future; the impact of new accounting pronouncements and tax laws; uncertainties affecting our ability to estimate our tax rate; the impact of expensing stock options and other equity awards; the sufficiency of our capital resources; factors related to our outstanding debt, revolving credit facility, term loan and loan associated with 50 Fremont; compliance with our debt covenants and lease obligations; current and potential litigation involving us; and the impact of climate change. Further information on these and other factors that could affect the company’s financial results is included in the reports on Forms 10-K, 10-Q and 8-K and in other filings it makes with the Securities and Exchange Commission from time to time. These documents are available on the SEC Filings section of the Investor Information section of the company’s website at www.salesforce.com/investor. Salesforce.com, inc. assumes no obligation and does not intend to update these forward-looking statements, except as required by law. Statement under the Private Securities Litigation Reform Act of 1995
3. What is the ESAPI? Introduce OWASP Open Web Application Security Project founded 2001 ESAPI Released (OWASP Enterprise Security API) OWASP releases Java ESAPI Salesforce releases Apex ESAPI 2010 This Talk 2019 New Encoding Util ESAPI.encoder.SFDC_BASE64_URLENCODE 2016 Timeline N.T.S. • Apex port of a Java security library • Input Validation ◦ ESAPI.validator.SFDC_isValidDate • Output Encoding ◦ ESAPI.encoder.SFDC_URLENCODE • Access Control for Salesforce objects ◦ insertAsUser/updateAsUser ◦ DML on a limited set of fields ◦ Override sharing for a single DML operation
4. 1. New repo owners: Chris Peterson & Jake Meredith of Salesforce a. Pull requests welcome! 2. CRUD, FLS and Sharing internals remodel a. Code coverage up from 54% -> 93% on security methods b. Meaningful assertions, and negative cases 3. Rewrite of field and object level security enforcement a. faster, easier to follow code 4. Housekeeping a. SFDX format b. markdown readme c. LICENSE file d. easy deploy button Adding additional security to system mode Apex (Re) Introducing the ESAPI https://sfdc.co/apex-esapi Now with 39% more test coverage!
5. A Recap of Security.stripInaccessible() SObjectAccessDecision Security.stripInaccessible( AccessType accessCheckType, List<SObject> sourceRecords ); AccessType Enum DescribeFieldResult method AccessType.READABLE isAccessible() AccessType.CREATABLE isCreatable() AccessType.UPDATABLE isUpdateable() AccessType.UPSERTABLE isUpdateable() && isCreatable() GA in Spring'20! Security Review Approved!
6. The SObjectAccessDecision Object Contains results of stripInaccessble Methods •List<SObject> getRecords() A clone of the input records with inaccessible fields removed •Set<Integer> getModifiedIndexes() All indexes of the input list that had fields stripped •Map<String, Set<String>> getRemovedFields() Contains details on all the fields that were removed from one or more records. Nested collection so that cross-object relationship fields can also be included
7. Name Appy's Apps Standing__c Overdue Value__c $100,000 System Mode (Trusted code can see all data) DML on User's behalf (Must enforce admin configured security) Security. stripInaccessible AccessType.CREATABLE Name Appy's Apps Standing__c (not defined) Value__c (not defined) Apex Security Enhancements Simple Field and Object Level Access Enforcement Input Output One Apex method call to cover FLS & CRUD • All field types • Relationship fields (e.g. Foo__r.Bar__r.Thing__c) • Subqueries Profiles & Permission Sets Check Access GA in Spring'20!
8. Mixing two good things How we enhanced the ESAPI with Security.stripInaccessible • Suspiciously close to ESAPI's updateAsUser/insertAsUser
9. Transitioning to stripInaccessible Code walkthrough
11. Performance tested using framework by Adrian Larson https://github.com/apexlarson/LimitsProfiler Measuring Performance
12. public class BulkInsertProfiler extends LimitsProfiler { transient Savepoint sp = null; List<Contact> c; private List<String> fieldsToCheck; public override void setup() { sp = Database.setSavepoint(); c = new List<Contact>(); for(integer i = 0; i<200; i++) { // Sets sample values into the 33 standard fields c.add(sampleContact(i)); } // 33 Standard fields fieldsToCheck = new List<String>{'LastName','FirstName','Salutation', /*...*/}; } public override void execute() { ESAPI.accessController ().insertAsUser(c, fieldsToCheck); } public override void tearDown() { Database.rollback(sp); } } Repeated per iteration
13. • Improvements on 25 iterations inserting 200 Contacts. 33 Standard fields Before and After A performance comparison 25% Less CPU usage 18.6% Less Heap usage
14. 1. ESAPI On GitHub ‒ https://sfdc.co/apex-esapi ‒ Improved Branch: feature/stripInaccessible Merge to master: Late Dec 2019 2. Security.stripInaccessible developer docs ‒ https://sfdc.co/apex-strip-doc 3. TDX19 Deeper Dive on Apex FLS/CRUD ‒ https://speakerdeck.com/ca_peterson/apex-object-and-field-security-made-easy Summary