Dreamforce/DreamTX 2020 Session Picks

Here are some of my current picks for Dreamforce/DreamTX 2020 sessions. Many of these sessions have repeats to better accomidate other timezones if required.

Monday, December 14th PST | Tuesday, December 15th NZDT

Salesforce Platform: Innovation Roadmap

Join us to learn about the latest Salesforce Platform innovations and product roadmap. Whether you're building with low-code tools, developing scalable apps on Heroku, or working to deliver a better employee experience, this episode will highlight new and upcoming Salesforce Platform products and features that make your job easier.

Thusrday, December 17th PST | Friday, December 18th NZDT

DreamTX Welcome Day 4: Skill Up with Trailhead

Join us to learn about the latest innovation on the Salesforce Platform to go digital fast, scale with confidence, and empower everyone.

Ask the Experts Live Q&A: Developer Experience

Join us to ask about how Salesforce is helping to make you a more productive salesforce developer, with experts from Apex, Salesforce Developer Tools and APIs with your host Heather Storm.

Build Connected Experiences on Salesforce

Join us and learn how to build modern customer and employee experiences on the Salesforce Platform. We’ll explore the latest innovations in Lightning Web Components, event-driven architectures, and Salesforce Functions.

Building Amazing Integrations with Apex

Apex is the workhorse of Salesforce development. Increasingly, however, more and more of our business logic takes the form of asynchronous work. Join us to learn what's new and upcoming in Asynchronous Apex including Salesforce Functions.

What’s New With Lightning Web Components

UI is the foundation of every app, and the Lightning Web Component Framework provides the building blocks needed to create new experiences that work inside and outside of Salesforce. Learn how to create custom interactions using the new NPM Base Components package, customize those interactions with SLDS styling hooks, then extend those interactions with enhanced LockerService support for 3rd party libraries. Finally, we’ll share a sneak peak of an upcoming pilot feature that will make it even easier to add data to your UI.

Ask the Experts Live Q&A: Roadmap Insights For Partners

Where are we going from here? Learn from our AppExchange and Platform experts as they share what Salesforce technologies should be top of mind for partners and how these technologies will help you grow your business. This session is live and our panel looks forward to engaging into a passionate Q&A.

See the Future of APIs at Salesforce

APIs are the glue that holds together most complex business processes. But despite their importance, the developer experience behind API use is often ignored. Join us for a sneak peek at brand new capabilities for using APIs from across the Salesforce Platform. We'll dive into our latest API innovations, such as the new Composite Graph API, and showcase never before seen features that will change how you learn, discover, and employ APIs in your development process.

Everything New in Salesforce Developer Tools

Your productivity starts and ends with the tools you use. Learn how Salesforce Developer Tooling can help you collaborate more effectively with your whole team. We'll show you the latest updates in Dev Tools including the new SOQL Query Builder.

---

Note that most of these sessions have repeats in other timezones. You can use the Themes to filter search results by region.

Mapping between Salesforce Permission Name and the Label

I recently ran into a minor challenge when deploying a Profile's metadata to an org when it came back with the error message:

"You may not modify the permission Run Macros on Multiple Records while editing a Standard Profile"

The profiles metadata doesn't contain the string "Run Macros on Multiple Records", so how do I know which userPermissions element I need to modify? I was able to narrow it down from the source diff on the file to BulkMacrosAllowed.

So my primary problem was solved, but it did leave me wondering why I couldn't find a more complete mapping of permission API names and the corresponding UI labels.

A small amount of research revealed the required information was in the PermissionSet field metadata. So then I just needed to iterate that metadata and put it into a more useful format (I.e. something I can Google).

The following was hastily extracted from a Summer '20 Dev org and merged with a Scratch Org from the same vintage using the v49.0 API. Your results may vary.

Updated for Winter '21 (v50.0). Just to be confusing it appears Salesforce has changed a couple of the UI Labels. So I've started keeping a versioned history of the changes to this page.

API Name	UI Label
AccessCMC	Access Community Management
AccessContentBuilder	Access drag-and-drop content builder
AccountSwitcherUser	Account Switcher User
ActivateContract	Activate Contracts
ActivateOrder	Activate Orders
ActivitiesAccess	Access Activities
AddAnalyticsRemoteConnections	Add Analytics Remote Connections
AddDirectMessageMembers	Add People to Direct Messages
AddWaveNotificationRecipients	Notification Emails: Add Recipients
AllowEmailIC	Email-Based Identity Verification Option
AllowLightningLogin	Lightning Login User
AllowUniversalSearch	Knowledge One
AllowViewEditConvertedLeads	View and Edit Converted Leads
AllowViewKnowledge	Allow View Knowledge
ApexRestServices	Apex REST Services
ApiEnabled	API Enabled
AssignPermissionSets	Assign Permission Sets
AssignTopics	Assign Topics
AuthorApex	Author Apex
B2BMarketingAnalyticsUser	Create B2B Marketing Analytics Apps
BotManageBots	Manage Bots
BotManageBotsTrainingData	Manage Bots Training Data
BulkApiHardDelete	Bulk API Hard Delete
BulkMacrosAllowed	Run Macros on Multiple Records
CampaignInfluence2	Campaign Influence
CanApproveFeedPost	Can Approve Feed Post and Comment
CanEditDataPrepRecipe	Edit Dataset Recipes
CanEditPrompts	Manage Prompts
CanInsertFeedSystemFields	Insert System Field Values for Chatter Feeds
CanManageMaps	Manage Analytics Custom Maps
CanUseNewDashboardBuilder	Drag-and-Drop Dashboard Builder
CanVerifyComment	Verify Answers to Chatter Questions
ChangeDashboardColors	Change Dashboard Colors
ChatterComposeUiCodesnippet	Allow Inclusion of Code Snippets from UI
ChatterEditOwnPost	Edit My Own Posts
ChatterEditOwnRecordPost	Edit Posts on Records I Own
ChatterFileLink	Create Public Links
ChatterInternalUser	Chatter Internal User
ChatterInviteExternalUsers	Invite Customers To Chatter
ChatterOwnGroups	Create and Own New Chatter Groups
CloseConversations	Close Conversation Threads
ConfigCustomRecs	Configure Custom Recommendations
ConnectOrgToEnvironmentHub	Connect Organization to Environment Hub
ConsentApiUpdate	Update Consent Preferences Using REST API
ContentAdministrator	Manage Salesforce CRM Content
ContentHubOnPremiseUser	Files Connect On-premises
ContentHubUser	Files Connect Cloud
ContentWorkspaces	Access Libraries
ConvertLeads	Convert Leads
CreateCustomizeDashboards	Create and Customize Dashboards
CreateCustomizeFilters	Create and Customize List Views
CreateCustomizeReports	Create and Customize Reports
CreateDashboardFolders	Create Dashboard Folders
CreateLtngTempFolder	Create Folders for Lightning Email Templates
CreateLtngTempInPub	Manage Public Lightning Email Templates
CreatePackaging	Create AppExchange Packages
CreateReportFolders	Create Report Folders
CreateReportInLightning	Report Builder (Lightning Experience)
CreateTopics	Create Topics
CreateWorkBadgeDefinition	Create custom Badge Definitions
CreateWorkspaces	Create Libraries
CustomizeApplication	Customize Application
CustomMobileAppsAccess	Access Custom Mobile Apps
CustomSidebarOnAllPages	Show Custom Sidebar On All Pages
CustomTabBarOnMobile	New Salesforce Mobile App - Customizable Navigation (Winter '20 Pilot Only)
DataExport	Weekly Data Export
DelegatedTwoFactor	Manage Multi-Factor Authentication in User Interface
DeleteActivatedContract	Delete Activated Contracts
DeleteTopics	Delete Topics
DistributeFromPersWksp	Create Content Deliveries
EditActivatedOrders	Edit Activated Orders
EditBrandTemplates	Manage Letterheads
EditCaseComments	Edit Case Comments
EditEvent	Edit Events
EditHtmlTemplates	Edit HTML Templates
EditKnowledge	Manage Articles
EditMyDashboards	Edit My Dashboards
EditMyReports	Edit My Reports
EditOppLineItemUnitPrice	Edit Opportunity Product Sales Price
EditPublicDocuments	Manage Public Documents
EditPublicFilters	Manage Public List Views
EditPublicReports	Manage Public Reports
EditPublicTemplates	Manage Public Classic Email Templates
EditReadonlyFields	Edit Read Only Fields
EditReports	Create and Customize Reports
EditTask	Edit Tasks
EditTopics	Edit Topics
EmailAdministration	Email Administration
EmailMass	Mass Email
EmailSingle	Send Email
EmailTemplateManagement	Manage Email Templates
EnableCommunityAppLauncher	Show App Launcher in Communities
EnableNotifications	Send Outbound Messages
ExportReport	Export Reports
FeedPinning	Pin Posts in Feeds
FieldServiceAccess	Field Service Standard
FieldServiceDispatcher	Field Service Dispatcher
FieldServiceLastMile	Field Service Last Mile
FieldServiceMobileApp	Field Service Mobile
FieldServiceScheduling	Field Service Scheduling
FlowUFLRequired	Require Flow User Feature License
ForceTwoFactor	Multi-Factor Authentication for User Interface Logins
FSCComprehensiveUserAccess	User license to access Lightning components and features delivered in Financial Services Cloud.
GiveRecognitionBadge	Give Recognition Badges in Lightning Communities
GovernNetworks	Manage Communities
HasUnlimitedNBAExecutions	User Has Unlimited Next Best Action Strategy Executions
HeadlessCMSAccess	Enable Salesforce CMS Integration
HideReadByList	Hide the Seen By List
IdentityConnect	Use Identity Connect
IdentityEnabled	Use Identity Features
ImportCustomObjects	Import Custom Objects
ImportLeads	Import Leads
ImportPersonal	Import Personal Contacts
InsightsAppAdmin	Manage Analytics
InsightsAppDashboardEditor	Create and Edit Analytics Dashboards
InsightsAppEltEditor	Edit Analytics Dataflows
InsightsAppUploadUser	Upload External Data to Analytics
InsightsAppUser	Use Analytics
InsightsCreateApplication	Create Analytics Apps
InstallPackaging	Download AppExchange Packages
IotUser	IoT User
IsotopeAccess	Salesforce Anywhere on Mobile
IsotopeCToCUser	Salesforce Anywhere Integration Access
IsotopeLEX	Salesforce Anywhere in Lightning Experience
LightningConsoleAllowedForUser	Lightning Console User
LightningExperienceUser	Lightning Experience User
ListEmailSend	Allow sending of List Emails
LMEndMessagingSessionUserPerm	End Messaging Session
LMOutboundMessagingUserPerm	Agent Initiated Outbound Messaging
LtngPromoReserved01UserPerm	Remain in Salesforce Classic
ManageAnalyticSnapshots	Manage Reporting Snapshots
ManageAuthProviders	Manage Auth. Providers
ManageBusinessHourHolidays	Manage Business Hours Holidays
ManageC360AConnections	Connect Org to Customer 360 Audiences
ManageCallCenters	Manage Call Centers
ManageCases	Manage Cases
ManageCategories	Manage Categories
ManageCertificates	Manage Certificates
ManageChatterMessages	Manage Chatter Messages and Direct Messages
ManageClearbitIntegration	Manage your Clearbit Integration
ManageCMS	Create CMS Workspaces and Channels
ManageContent	Manage Content Permissions
ManageContentProperties	Manage Content Properties
ManageContentTypes	Manage record types and layouts for Files
ManageCssUsers	Manage Customer Users
ManageCustom	Manage Custom Permissions
ManageCustomReportTypes	Manage Custom Report Types
ManageDashbdsInPubFolders	Manage Dashboards in Public Folders
ManageDashboards	Manage Dashboards
ManageDataCategories	Manage Data Categories
ManageDataIntegrations	Manage Data Integrations
ManageDynamicDashboards	Manage Dynamic Dashboards
ManageEmailClientConfig	Manage Email Client Configurations
ManageEncryptionKeys	Manage Encryption Keys
ManageExchangeConfig	Manage Lightning Sync
ManageExternalConnections	Allow user to modify Private Connections
ManageHealthCheck	Manage Health Check
ManageHubConnections	Connect Org to Customer 360 Data Manager
ManageInteraction	Manage Flow
ManageInternalUsers	Manage Internal Users
ManageIpAddresses	Manage IP Addresses
ManageKnowledge	Manage Salesforce Knowledge
ManageKnowledgeImportExport	Manage Knowledge Article Import/Export
ManageLeads	Manage Leads
ManageLoginAccessPolicies	Manage Login Access Policies
ManageMobile	Manage Mobile Configurations
ManageNetworks	Create and Set Up Communities
ManagePasswordPolicies	Manage Password Policies
ManageProfilesets	Manage Profiles and Permission Sets
ManagePropositions	Manage Next Best Action Recommendations
ManagePvtRptsAndDashbds	Manage All Private Reports and Dashboards
ManageRecommendationStrategies	Manage Next Best Action Strategies
ManageReleaseUpdates	Manage Release Updates
ManageRemoteAccess	Manage Connected Apps
ManageReportsInPubFolders	Manage Reports in Public Folders
ManageRoles	Manage Roles
ManageSearchPromotionRules	Manage Promoted Search Terms
ManageSecurityCommandCenter	Manage Security Center
ManageSelfService	Manage Self-Service Portal
ManageSessionPermissionSets	Manage Session Permission Set Activations
ManageSharing	Manage Sharing
ManageSolutions	Manage Published Solutions
ManageSubscriptions	Manage Analytics Subscriptions
ManageSurveys	Manage Surveys
ManageSynonyms	Manage Synonyms
ManageTemplatedApp	Manage Analytics Templated Apps
ManageTwoFactor	Manage Multi-Factor Authentication in API
ManageUnlistedGroups	Manage Unlisted Groups
ManageUsers	Manage Users
ManageZapierIntegration	Manage your Zapier Integration
MassInlineEdit	Mass Edits from Lists
MergeTopics	Merge Topics
ModerateChatter	Moderate Chatter
ModerateNetworkUsers	Moderate Community Users
ModifyAllData	Modify All Data
ModifyDataClassification	Modify Data Classification
ModifyMetadata	Modify Metadata Through Metadata API Functions
ModifySecureAgents	Modify Secure Agents
NativeWebviewScrolling	Salesforce Mobile App: Native scrolling on webviews
NewReportBuilder	Report Builder
OptOutGeoLocationTracking	Exclude Technician from Geolocation Tracking
Packaging2	Create and Update Second-Generation Packages
Packaging2Delete	Delete Second-Generation Packages
PasswordNeverExpires	Password Never Expires
PreventClassicExperience	Hide Option to Switch to Salesforce Classic
PrivacyDataAccess	Allow user to access privacy data
PublishPackaging	Upload AppExchange Packages
QueryAllFiles	Query All Files
QuipMetricsAccess	Quip Metrics
QuipUserEngagementMetrics	Quip User Engagement Metrics
RecordVisibilityAPI	Enable RecordVisibility API
RemoveDirectMessageMembers	Remove People from Direct Messages
ResetPasswords	Reset User Passwords and Unlock Users
RunFlow	Run Flows
RunReports	Run Reports
SalesConsole	Sales Console
SandboxTestingInCommunityApp	Enables testing a sandbox community in the Mobile Publisher for Community Cloud app.
ScheduleReports	Schedule Reports
SelectFilesFromSalesforce	Select Files from Salesforce
SendAnnouncementEmails	Send announcement emails
SendCustomNotifications	Send Custom Notifications
SendExternalEmailAvailable	Send Email through External Email Service
SendSitRequests	Send Stay-in-Touch Requests
ShareInternalArticles	Share internal Knowledge articles externally
ShowCompanyNameAsUserBadge	Show Company Name as Community Role
SkipIdentityConfirmation	Skip Identity Confirmation at Login
SolutionImport	Import Solutions
SubmitMacrosAllowed	Manage Macros Users Can't Undo
SubscribeDashboardRolesGrps	Subscribe to Dashboards: Send to Groups and Roles
SubscribeDashboardToOtherUsers	Subscribe to Dashboards: Add Recipients
SubscribeReportRolesGrps	Subscribe to Reports: Send to Groups and Roles
SubscribeReportsRunAsUser	Subscribe to Reports: Set Running User
SubscribeReportToOtherUsers	Subscribe to Reports: Add Recipients
SubscribeToLightningDashboards	Subscribe to Dashboards
SubscribeToLightningReports	Subscribe to Reports
TraceXdsQueries	Access Tracer for External Data Sources
TransactionalEmailSend	Send Non-Commercial Email
TransferAnyCase	Transfer Cases
TransferAnyEntity	Transfer Record
TransferAnyLead	Transfer Leads
TwoFactorApi	Multi-Factor Authentication for API Logins
UseSubscriptionEmails	Use Subscription Emails
UseTeamReassignWizards	Use Team Reassignment Wizards
UseTemplatedApp	Use Analytics Templated Apps
UseWebLink	Allow Access to Customized Actions
ViewAllActivities	View All Activities
ViewAllCustomSettings	View All Custom Settings
ViewAllData	View All Data
ViewAllForeignKeyNames	View All Lookup Record Names
ViewAllProfiles	View All Profiles
ViewAllUsers	View All Users
ViewAnomalyEvents	View Threat Detection Events
ViewContent	View Content in Portals
ViewDataAssessment	Access to view Data Assessment
ViewDataCategories	View Data Categories in Setup
ViewDataLeakageEvents	View Real-Time Event Monitoring Data
ViewEncryptedData	View Encrypted Data
ViewEventLogFiles	View Event Log Files
ViewFlowUsageAndFlowEventData	View Flow Usage and Flow Event Data
ViewHealthCheck	View Health Check
ViewHelpLink	View Help Link
ViewMyTeamsDashboards	View My Team's Dashboards
ViewOnlyEmbeddedAppUser	Access to View-Only Licensed Templates and Apps
ViewPlatformEvents	View Login Forensics Events
ViewPrivateStaticResources	View Private Static Resources
ViewPublicDashboards	View Dashboards in Public Folders
ViewPublicReports	View Reports in Public Folders
ViewRoles	View Roles and Role Hierarchy
ViewSecurityCommandCenter	View Security Center pages
ViewSetup	View Setup and Configuration
ViewUserPII	View User Records with PII
WaveManagePrivateAssetsUser	Manage Analytics Private Assets
WaveTabularDownload	Download Analytics Data
WorkCalibrationUser	Enable WDC Calibration
WorkDotComUserPerm	Enable WDC

FuseIT SFDC Explorer 3.15.20209.3 - Summer '20

Another roundup of some of the changes to the FuseIT SFDC Explorer since the 3.13.20008.1 release.

Display the primary sObject type for a SOQL query in the executed units

When looking at the "Show Executed Units" for a debug log that includes SOQL queries there is a new "SOQL Primary sObject" column. This makes it easier to sort the SOQL queries in the transaction by the sObject they were operating over.

There is also a new context menu option in the executed units area to filter the main log view to just the selected events.

Other changes include tracking Flow executed units and SOQL Total Rows metrics from debug logs.

Add the MetadataComponentDependency API calls via the Bulk API 2.0

Previously the Metadata Dependencies tab was limited by the underlying MetadataComponentDependency API only supporting queries over 2,000 records in a single query. Switching to the bulk API expands this out to 100,000 dependency records.

There is also a new experimental graph format called "Microsoft Automatic Graph". This will use a built in graph layout tool. It is no where near as powerful as Gephi, but it is built in and allows you to gradually build the graph up. E.g. try starting with a single ID against "Where is it used" and then using the context menus to expand the graph incrementally.

Rebuilt login and authentication controls.

The various login and authentication controls that are displayed on app startup have a more consistent UI. For example, they have a consistent Login button.

Other changes 3.15

• Update SalesforceSession so that all APIs are working against v49.0 - Summer 20
• Apex logging - add SOQL_EXECUTE_EXPLAIN Log event
• Update SOQLResult column names when the defaultNamespace is defined. Includes first level relationship fields.
• SFDCExplorer: Executed Units Context Menu to set Apex Log filter
• SFDCExplorer: Show a message if there are issues showing an individual entity
• SFDCExplorer: Support for flow log message types. Guard against debug logs with recursive search depth that is too great.
• SFDCExplorer: Exception Handling when showing reports.
• wsdl2apex: Warn if the schemaTypeName is missing.
• SFDCExplorer: Expand Graph search ability
• SFDCExplorer: Format VF_ log events in the timeline Handle deeply nested log structures to prevent stack overflows.
• SFDCExplorer: Format byte size of log. Handling clicking a record ID in the log that doesn't exist in the current org. Option to format Callout requests in the debug log.
• SFDCExplorer: Ensure the popup window that shows SOQL sub query results has a unique name so that the caching key is unique.
• Tooling API. Check access to the DebugLevel metadata before attempting to query it.
• SFDCExplorer: always prompt for directory to save metadata to.
• Update All API versions to Spring 2020 (v48.0)
• SFDCExplorer: Update .NET Framework version to 4.7.2 and add support for scaling to high DPI monitors.
• SFDCExplorer: Update to cs31623 to allow for variation in the instanceUrl provided by the SFDX CLI
• SFDCExplorer: Auto expand the test class search node when searching. Detect test classes in the queued state
• SFDCExplorer: Export the results of a Bulk CSV load. This is useful if there where errors with the operation on individual records.
• SFDCExplorer: Log metrics for callouts
• Tooling API: Correct updating the log levels on TraceFlags

Dreamforce 2019 Presentation - Reducing the Cost of Enforcing CRUD and FLS in the ESAPI

At Dreamforce this last year (2019) Chris Peterson and I gave a theater presentation on combining the new Apex Security.stripInaccessible method with the existing ESAPI library for enforcing Create, Retrieve, Update, Delete (CRUD) and field level security (FLS) in Apex.

Unfortunately the Dreamforce theater sessions weren't recorded in 2019 as they were in previous years 🤦‍♂️. To make up for that, below are the session slides. I'll also expand on the key points in this blog post. These will be my words rather than Chris's, although I'll try and cover most of the same content.

Slides from #DF19: Reducing the cost of enforcing FLS & CRUD in the ESAPI https://t.co/T0Cl0MscJv with @FishOfPrey

— Chris Peterson (@ca_peterson) November 21, 2019

What is the ESAPI?

The ES stands for Enterprise Security. And the API... Well, hopefully you know what an API is.

The Salesforce ESAPI is a port of a Java library created by OWASP (Open Web Application Security Project).

To address why you would want it in your Salesforce org, here is a quote from the OWASP ESAPI project page:

The ESAPI libraries are designed to make it easier for programmers to retrofit security into existing applications. The ESAPI libraries also serve as a solid foundation for new development.

These seem like noble goals. We want to improve the security of existing applications and implement newer applications with the same level of security from the start.

The three core areas that the Salesforce ESAPI addresses are:

1. Input Validation - is a given string a valid date? Is it a valid credit card number? A valid redirection URL?
   • E.g. ESAPI.validator.SFDC_isValidDate
2. Output Encoding - is is safe to render the content back to the users browser via HTML?
   • E.g. ESAPI.encoder.SFDC_URLENCODE
3. Access Control - enforce the built in access control mechanisms: CRUD, FLS, and Sharing.
   • insertAsUser/updateAsUser
   • DML on a limited set of fields
   • Override sharing for a single DML operation

(Re) Introducing the ESAPI

Salesforce originally released their version of the ESAPI library in 2010. In 2016 they added the new ESAPI.encoder.SFDC_BASE64_URLENCODE method. Other than that it was stalled for any maintenance or new development.

In 2019 Chris Peterson and Jake Meredith from Salesforce took ownership of the Github repo. Even better, they are accepting pull requests.

One of the first steps in rejuvenating the repo was to increase the built in code coverage from 54% to 93% on the security specific test methods. And, perhaps more importantly, add a number of meaningful assertions and negative test cases along the way. Overall project test coverage is now up by 39%.

One of the particular challenges with this was scripting out of the box test cases using only the built in Profiles and sObjects. The test cases needed to be portable to any org, so they couldn't rely on a specific custom Profile existing. At the time the "Read Only" profile was the most restrictive system profile available. Going forward I might revisit this with the still to GA Minimum Access profile.

There is a new Minimum Access profile in #salesforce #summer20.
It may seem like a small thing, but if you've every tried to full control access with permissions sets or had to create such a profile yourself you will know what a useful time saver this will be.#Summer20Treasure pic.twitter.com/SWBMqfSxM3

— Daniel Ballinger 🦈 (@FishOfPrey) April 28, 2020

With the better test coverage in place it was then possible to overhaul how the field and object level security was enforced. More on that later...

A Recap of the Security.stripInaccessible() method

The Spring '20 release included the GA version of the new Security.stripInaccessible method.

This new method provides a streamlined way to check both field and object level data permissions for the following access types:

• AccessType.READABLE - Check the fields of an sObject for read access.
• AccessType.CREATABLE - Check the fields of an sObject for create access.
• AccessType.UPDATABLE - Check the fields of an sObject for update access.
• AccessType.UPSERTABLE - Check the fields of an sObject for insert and update access.

The SObjectAccessDecision Object

After calling stringInaccessible() an SObjectAccessDecision object is returned. This provides a number of helpful methods.

getRecords() provides a new List<SObject> that has all the inaccessible fields removed. These are also detached from the source sObjects.

Two additional methods getModifiedIndexes() and getRemovedFields() provide details about which records and specific fields were modified.

How it works in practice to enforce security requirements

Using the newer stringInaccessible method has a number of advantages. It will cover all possible sObject field types. It will check relationship fields, including nested relationships. Sub-queries and polymorphic lookups are also covered.

The example in the image above shows a new Opportunity for "Appy's App" that was generated in the trusted system mode. As such, it could set the custom Standing__c and Value__c fields. This Opportunity is then passed through stringInaccessible with the AccessType.CREATABLE parameter. This does all the hard work for us of checking the users Profiles, Permission Sets, the Permission Set groups, the muting permission sets, etc... The output Opportunity has the fields that the user doesn't have create access to completely removed. The stripped fields aren't null: they're really undefined. This is important when it comes to subsequent DML as we don't want to inadvertently clear fields out.

Other advantages:

• It's particularly useful when handling untrusted input (like from JavaScript controllers)
• It's also great for gracefully degrading UI experiences like SFDC does natively

Example walk through code the changes to the ESAPI

The video shows the core structural changes that were made to the ESAPI methods to use the new methods.

Measuring the Performance changes - Methodology

Beyond enforcing the security requirements the next important consideration is changes to CPU Limit usage and Heap usage. Usually you trade more CPU for less Heap or vice versa. If we can cut both down we are doing well!

The general goal is always to see equal of better performance while enforcing the same security requirements. There may be some tradeoffs in performance made, but the security can't be compromised on. The coverage and assertions from the automated tests ensure we are still enforcing the same security requirements.

The performance differences in terms of Apex limits were measured using Test harness classes and Adrian Larsons LimitsProfiler framework. Performing multiple runs between the current/baseline implementation and the new version using the stripping methods allows the relative changes in limits to be measured.

During the testing it was important to have the debug logging completely off as it would otherwise affect the outcomes.

The testing below was done in ALL_OR_NONE mode. This is more demanding than the alternative BEST_EFFORT mode as it requires per field level checks.

To allow for the limits testing framework to repeatedly insert multiple records Savepoints were used as part of the setup and teardown steps. This prevented hitting the storage limits while still measuring the performance differences in the ESAPI.

Measured results for bulk inserting Contacts

The performance difference can vary greatly based on scenario:

• There is negligible performance difference when checking object CRUD permissions. Note, the Apex ESAPI is still enforcing against the sObject Schema.SObjectType until 224 (Spring `20) with the fix.
• There is a significant performance difference if there are a large number of requested fields that aren’t set on all the sObjects.

Measured improvements on 25 iterations inserting 200 Contacts. 33 Standard fields

• 25% Less CPU usage
• 18.6% Less Heap usage

Links and Resource

• ESAPI on GitHub
• Security.stripInaccessible developer docs
• TDX19 Deeper Dive on Apex FLS/CRUD
• Learn MOAR in Spring ’20 with Field Level Security in Apex

FuseIT SFDC Explorer 3.13.20008.1 - Winter '20

Another roundup of some of the changes to the FuseIT SFDC Explorer since the 3.12.19175.1 release.

Redesigned Apex Tests selector

The Apex test selection control has been reworked to include a top level node for the last known state of each test method. This allows you to monitor the accumulated test results from a single location. If you redeploy one of the test cases in question it will reset to an unknown status.

Updates to the Debug Log Executed Units

In the last release I put in the first version of the Executed Units control. This release builds on that.

It is now possible to mix and match the different log types. So you can focus on, for example, just the SOQL queries.

The same toolstrip includes a button to export the executed units data.

Smaller generated Wsdl2Apex classes

If you've ever looked closely at the Apex classes that Wsdl2Apex generates you'll notice a recurring string - the namespace of the the root element. Depending on the WSDL it's not uncommon for this same string to be repeated thousands of times in the generated Apex class. This update will now generate a single static final to handle the repeated usages.

New controls for exploring Execution overlays, including heap dumps

The developer console currently provides a viewer for execution overlay output created by a ApexExecutionOverlayAction record. This includes the Heap Dump, which has all sorts of interesting details about the data stored in heap/memory for the transaction at the the point of time the overlay was captured.

Right now it mostly just replicates the existing developer console functionality and allows browsing the stored objects by type.

Other changes 3.13

• [cs32197] SFDCExplorer: Option to save a debug log directly to disk.
• [cs32152] SFDCExplorer: Auto add metadata files when adding package components. Update display of Metadata Deploy results.
• [cs32150] SFDCExplorer: Allow the target save directory to be specified when doing an unpackaged metadata export (if the working directory isn't accessible)
• [cs32149] SFDCExplorer: Use internal list of known key prefixes with the Entity Explorer
• [cs32148] SFDCExplorer: Option on running SOQL queries to include deleted rows
• [cs32003] Update to Winter '20 release. v47.0
• [cs31838] Wsdl2Apex: Handle an operation binding with no output. Raising a warning for a missing portType rather than an exception.
• [cs31820] SFDCExplorer: Hide JavaScript errors during OAuth login