Summer '19 リリースノート > 開発 > Apex

Summer'19 Apex 新機能のご紹介

1. Apex とは
2. Apex セキュリティ新機能とその利用例
3. デモ（インジェクションを試してみた）
https://github.com/capeterson/tdx19-insecure-lwc-sample

対象者
- Salesforce 開発者（特に Apex 好き）
- AppExchange アプリケーション開発者
- セキュリティエンジニア

目的
- 強化されたセキュリティ機能の概要を伝える
- 新機能のフィードバックを得る

Transcript

1. 1 ' 4/8 K @ A 9 ( 2 01 3 ) 2 01
2. This presentation may contain forward-looking statements that involve risks, uncertainties, and assumptions. If any such uncertainties materialize or if any of the assumptions proves incorrect, the results of salesforce.com, inc. could differ materially from the results expressed or implied by the forward-looking statements we make. All statements other than statements of historical fact could be deemed forward-looking, including any projections of product or service availability, subscriber growth, earnings, revenues, or other financial items and any statements regarding strategies or plans of management for future operations, statements of belief, any statements concerning new, planned, or upgraded services or technology developments and customer contracts or use of our services. The risks and uncertainties referred to above include – but are not limited to – risks associated with developing and delivering new functionality for our service, new products and services, our new business model, our past operating losses, possible fluctuations in our operating results and rate of growth, interruptions or delays in our Web hosting, breach of our security measures, the outcome of any litigation, risks associated with completed and any possible mergers and acquisitions, the immature market in which we operate, our relatively limited operating history, our ability to expand, retain, and motivate our employees and manage our growth, new releases of our service and successful customer deployment, our limited history reselling non-salesforce.com products, and utilization and selling to larger enterprise customers. Further information on potential factors that could affect the financial results of salesforce.com, inc. is included in our annual report on Form 10-K for the most recent fiscal year and in our quarterly report on Form 10-Q for the most recent fiscal quarter. These documents and others containing important disclosures are available on the SEC Filings section of the Investor Information section of our Web site. Any unreleased services or features referenced in this or other presentations, press releases or public statements are not currently available and may not be delivered on time or at all. Customers who purchase our services should make the purchase decisions based upon features that are currently available. Salesforce.com, inc. assumes no obligation and does not intend to update these forward-looking statements. Forward-Looking Statement Statement under the Private Securities Litigation Reform Act of 1995
3.  
   6 4 c S 0 24 gi k l eh E 0 24 a Z A 0 0 4 624 @ 4 o nf
4. 19 • • A • • ( ) A
5. A  2 af l 2 2 af h 
   • 1 . g 2 • 2 E 3 • E  • c af • af 3 S e
7. - c o l e l l b VS AW rf l s a a l s e f S V ” “ V S v i b S - u fJI P I e x l p f fi b c p S rf l l S “
8. • I P g • c xgnv L i v c • - - nscfl pJ e P • f f J g Pl p • rx P rx I g P a x J ü S ü - - nscfl pJ h A P ot hxf
9. Apex on the Lightning Platform
10. , a fC hg VW c tm ! B , ? bU ! B S V I S V s ! E C V U AL U VbU e ! F Batch Apex xnilo d C A / / p C ruI! //
11. . 2  
       
12. SObjectAccessDecision Security.stripInaccessible( AccessType accessCheckType, List<SObject> sourceRecords, [Boolean enforceRootObjectCRUD]) AccessType Enum DescribeFieldResult method AccessType.READABLE isAccessible() AccessType.CREATABLE isCreatable() AccessType.UPDATABLE isUpdateable() Open Pilot! Summer '19 S )( . . (() ) I ) AS
13. S s I ( ) ) A I Md S ( n jc b O a D j I o Sc i aS ( ) SA j O t lnA SA j ph r e t A
14. L M W S M W 3 - C 1 M W D O 2 :
15. D A 1- List<Account> accounts = new List<Account>{ new Account(Name='Account1', AnnualRevenue=1000), new Account(Name='Account2') }; // Strip fields that are not creatable SObjectAccessDecision decision = Security.stripInaccessible( AccessType.CREATABLE, accounts);
16. - 1 // Safe insert - does not create AnnualRevenue insert decision.getRecords(); // Print results for (SObject strippedAccount : decision.getRecords()) { System.debug('Inserted account: ' + strippedAccount); } System.debug('Modified records: ' + decision.getModifiedIndexes()); System.debug('Removed fields: ' + decision.getRemovedFields()); D
17. Inserted account: Account:{Name=Account1, Id=00130000001nFfpIAE} Inserted account: Account:{Name=Account2, Id=00130000001nFfqIAE} Modified records: {0} Removed fields: {Account={AnnualRevenue}} 1 D - D
18. R Id Name Amount Business Unit User a0030000000iZbYIAU Expense_Report1 1000 Marketing 00530000000HgGwIAK a0030000000iZbZIAU Expense_Report2 4000 Sales 00530000000HgGxIAK Id Social Security 00530000000HgGwIAK 555-44-3333 00530000000HgGxIAK 777-88-9999 2 2 S - E 2 2E
19. 2- // Strip fields that are not readable SObjectAccessDecision decision = Security.stripInaccessible( AccessType.READABLE, [SELECT Name, Amount__c, Business_Unit__c, User__r.Social_Security__c FROM Expense_Report__c] );
20. 2- // Print results - does not display Social Number for (SObject obj : decision.getRecords()) { Expense_Report c rpt = (Expense_Report c)obj; System.debug('Expense Report: ' + rpt); User usr = (User)rpt.getSobject('User r'); System.debug('User: ' + usr); } System.debug('Modified records: ' + decision.getModifiedIndexes()); System.debug('Removed fields: ' + decision.getRemovedFields());
21. Security.stripInaccessible - 2 Expense Report: Expense_Report__c:{Name=Expense_Report1, Amount__c=1000, Business_Unit__c=Marketing, User__c=00530000000HgGwIAK, Id=a0030000000iZbYIAU} User:{Id=00530000000HgGwIAK} Expense Report: Expense_Report__c:{Name=Expense_Report2, Amount__c=4000, Business_Unit__c=Sales, User__c=00530000000HgGxIAK, Id=a0030000000iZbZIAU} User:{Id=00530000000HgGxIAK} Modified records: {0, 1} Removed fields: {User={Social_Security__c}}
22. - 3 List<SObject> project = new List<SObject>{ new Account(Name='Account1', Flag1__c=1), new Opportunity(Name='Opportunity1') }; SObjectAccessDecision decision = Security.stripInaccessible( AccessType.UPDATABLE, project);
23. - 3 // Verify stripped records for (SObject strippedRecord : decision.getRecords()) { switch on strippedRecord { when Account a { System.assertEquals(true, a.isSet('Name')); System.assertEquals(false, a.isSet('Flag1 c')); } when Opportunity o { System.assertEquals(true, o.isSet('Name')); } }
25. • a hic np o C D https://releasenotes.docs.salesforce.com/ja-jp/summer19/release-notes/rn_apex_Security_stripInaccessible.htm F f - - ) ( https://success.salesforce.com/ideaView?id=08730000000Lj8GAAS • S e D https://developer.salesforce.com/docs/atlas.ja-jp.apexcode.meta/apexcode/apex_class_System_Security.htm • dg R I L LU rD A E https://github.com/capeterson/tdx19-insecure-lwc-sample https://twitter.com/ca_peterson/status/1133816972590759936
26.     The only reason it's a pilot is so we can change things. https://sfdc.co/stripinacessible-feedback https://sfdc.co/stripinacessible-feedback-JP sfdc.co/AppX-Dev-JP @ca_peterson @tak4hir0 or