Back when the whole Guest User Security thing started, I ran into an issue with queries to certain setup objects from Guest Users. The metadata reported that the objects where inaccessible when should be. In order to work around that issue, I have one class that is declared without sharing that does not do CRUD/FLS checks. This class queries Group, GroupMember, UserRole, and OrgWideEmailAddress.
Anyone know if that issue has been fixed?
We're about to go through security review and if the issue is fixed, I can change the class declaration and add WITH SECURITY_ENFORCED to the queries. If the issue is not fixed, I'll have to document it as a false positive.
1 条评论
These are considered "setup" objects, which we don't want to be accessed by a guest user. So you will have to continue doing this in a without sharing class, but the AppExchange security team should be aware of this pattern. If you have any issues with reviews there please post back here and we can help with alignment.
