--- schema_version: "1" id: 40c02976aecb99b41bd0af1887d83bb60540f9d002d1f7838f32abfbda199c73 title: ApexFlsViolationRule (Retired) collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/code-analyzer/salesforce-code-analyzer/guides/v3x/salesforce-graph-engine/apexflsviolation-rule.md canonical_url: https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/apexflsviolation-rule.html source_site: developer.salesforce.com content_type: documentation content_hash: 82373d31a7a7792e345ef4276406dae7f8a549f03107f735cd5a5e554f27ab5c products: - Salesforce Code Analyzer --- # ApexFlsViolationRule (Retired) ApexFlsViolationRule detects Create, Read, Update, and Delete and Field-Level Security (CRUD/FLS) violations. ## Definition - Source - : `@AuraEnabled`-annotated methods. `@InvocableMethod`-annotated methods. `@NamespaceAccessible`-annotated methods. `@RemoteAction`-annotated methods. Any method returning a `PageReference` object. `public`-scoped methods on Visualforce Controllers. `global`-scoped methods on any class. `Messaging.InboundEmailResult handleInboundEmail()` methods on implementations of `Messaging.InboundEmailHandler`. Any method targeted during invocation. - Sink - : All DML operations and their `Database.method()` counterparts: delete, insert, merge, undelete, update, and upsert. SOQL queries and Database.query counterpart. - Sanitizer - : Access check performed using [Schema.DescribeSObjectResult](https://developer.salesforce.com/docs/atlas.en-us.234.0.apexref.meta/apexref/apex_methods_system_sobject_describe.htm). Acceptable only for operations that require CRUD-level checks such as DELETE, UNDELETE, and MERGE. Access check performed using [Schema.DescribeFieldResult](https://developer.salesforce.com/docs/atlas.en-us.234.0.apexref.meta/apexref/apex_methods_system_fields_describe.htm). Acceptable for operations that require FLS-level checks. Includes READ, INSERT, UPDATE, UPSERT for standard data objects and custom objects. SOQL queries that use [WITH SECURITY_ENFORCED](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_with_security_enforced.htm#apex_classes_with_security_enforced). Lists filtered by [Security.stripInaccessible](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_with_security_stripInaccessible.htm). ## Interpreting Results Match any violation message that you receive with these cases to understand more about the violation. ### Common Case > _Validation-Type_–validation is missing for _Operation-Name_ operation on _Object-Type_ with fields _Comma-Separated-Fields_ where: - _Validation-Type_ - : Type of validation to be added. CRUD requires object-level checks, and FLS requires field-level checks. - _Operation-Name_ - : Data operation that must be sanitized. - _Object-Type_ - : Object on which the data operations happen. If Graph Engine couldn’t guess the object type, you see the variable name or _SFGE_Unresolved_Argument_. - _Comma-Separated-Fields_ - : Fields on which the data operation works. If you see _Unknown_ as the only field or as one of the fields, Graph Engine doesn't have enough information to guess the fields, and you must determine the unlisted fields manually. ### Additional Clause Case > _Validation-Type_ validation is missing for _Operation-Name_ operation on _Object-Type_ with fields _Comma-Separated-Fields_–Graph Engine couldn't parse all objects and fields correctly. Manually confirm if the objects and fields involved in these segments have FLS checks: _Unknown-Segments_ where: - _Validation-Type_ - : Type of validation to be added. CRUD requires object-level checks, and FLS requires field-level checks. - _Operation-Name_ - : Data operation that must be sanitized. - _Object-Type_ - : Object on which the data operations happen. If Graph Engine couldn’t guess the object type, you see the variable name or _SFGE_Unresolved_Argument_. - _Comma-Separated-Fields_ - : Fields on which the data operation works. If you see _Unknown_ as the only field or as one of the fields, Graph Engine doesn't have enough information to guess the fields, and you must determine the unlisted fields manually. This case is the same as the common case, but also Graph Engine isn't confident about the object names or field names that it detected. You also see this clause when your field or object ends with `__r`. In both cases, review the relational field, object, and the unparsed segments to ensure that they have the required CRUD/FLS checks. Next, add an [engine directive](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/salesforce-graph-engine/working-with-graph-engine.md) to force Graph Engine to ignore this warning in the next run. ### stripInaccessible Warning Case The `stripInaccessible` warning is thrown for all `stripInaccessible` checks on READ access type. Graph Engine can't ensure that the sanitized value returned by `SecurityDecision` is the value used in the code that follows the check. Confirm the values manually, then add an engine directive to force Graph Engine to ignore this warning in the next run. Or, disable these violations by using the `--rule-disable-warning-violation` flag or by setting its corresponding environment variable, SFGE_RULE_DISABLE_WARNING_VIOLATION, to true. ### Internal Error Case > Graph Engine identified your source and sink, but you must manually verify that you have a sanitizer in this path. Then, add an engine directive to skip the path. Next, create a GitHub issue for the Code Analyzer team that includes the error and stack trace. After we fix this issue, check the Code Analyzer release notes for more info. Error and stacktrace: [details] Graph Engine encountered an error while walking this path. Manually verify that you have a sanitizer on the path, and then add an engine directive to skip the path. Next, create a GitHub issue for the Code Analyzer team that includes the error and stack trace so that we can research and resolve it. After we determine a fix for the issue, check Code Analyzer [Release Notes](https://developer.salesforce.com/docs/platform/relnotes/release-notes.md) for more info. ## See Also - [_YouTube_: Create, Read, Update, and Delete (CRUD) and Field-Level Security (FLS) Violations](https://www.youtube.com/watch?v=1ZYjpjPTIn8) - [_Apex Developer Guide_: Enforce Security With the stripInaccessible Method](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_with_security_stripInaccessible.htm) - [_Apex Developer Guide_: Enforcing Object and Field Permissions](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_perms_enforcing.htm) - [_Apex Developer Guide_: Filter SOQL Queries Using WITH SECURITY_ENFORCED](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_with_security_enforced.htm) - [Salesforce Code Analyzer FAQ](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/faq.md)