How do I validate a credit card number in Apex with ESAPI?

Use ESAPI.validator().getValidCreditCard(input, false) for exception-based validation or isValidCreditCard() for boolean checks, as shown in the README. This ensures server-side validation to prevent injection attacks in Salesforce custom code.

What's the difference between ESAPI and Salesforce's native Visualforce encoding functions?

ESAPI provides encoding functions like SFDC_HTMLENCODE within Apex classes, allowing programmatic control, while native functions are limited to Visualforce markup. ESAPI integrates encoding into business logic for more flexible security handling, as highlighted in the output encoding example.

How to enforce CRUD permissions in Apex using ESAPI?

Call ESAPI.accessController().updateAsUser(sObject, fields) to perform updates in user context, enforcing CRUD and FLS. Wrap it in a try-catch block to handle SFDCAccessControlException, as demonstrated in the access control section of the README.

Is Force.com ESAPI compatible with Salesforce DX?

Yes, ESAPI can be deployed to Salesforce orgs managed with Salesforce DX by uploading the classes or using the provided one-click deployment link. However, it's not natively integrated into DX workflows, requiring manual steps for setup and updates.

Force.com ESAPI vs writing custom validation code – which is better?

ESAPI offers a standardized, tested approach to security, reducing manual errors and ensuring compliance with best practices. Custom code might offer more flexibility but can introduce vulnerabilities, so ESAPI is recommended for team-based or regulated environments.

How to handle access control violations in ESAPI?

Catch SFDCAccessControlException in try-catch blocks after access controller calls, then use e.getMessage() or specific methods like getExceptionType() to log or display secure error messages, as shown in the README example for detailed exception handling.

Force.com ESAPI — Security Library for Apex

What is Force.com ESAPI?

Force.com ESAPI is an open-source Enterprise Security API for the Apex programming language on the Salesforce Force.com platform. It provides developers with tools to validate input, encode output, and enforce access controls, helping to prevent common security vulnerabilities like injection attacks and unauthorized data access in custom Salesforce applications.

Target Audience

Salesforce developers and administrators building custom Apex applications on the Force.com platform who need to implement robust security measures and comply with Salesforce security best practices.

Value Proposition

Developers choose Force.com ESAPI because it seamlessly integrates security enforcement into Apex code, offering a standardized way to handle validation, encoding, and access control that aligns with Salesforce's security models, reducing manual security implementation errors.

Enterprise Security API for the Apex language on the Force.com platform.

Use Cases

Best For

Validating untrusted user input in Apex controllers
Encoding output for safe display in Visualforce pages
Enforcing CRUD and FLS permissions in system context Apex code
Implementing sharing rule enforcement in custom Apex logic
Preventing injection attacks in Salesforce custom applications
Handling security exceptions with detailed error messages in Apex

Not Ideal For

Teams building applications primarily with Salesforce Lightning Web Components, as ESAPI is designed for Apex and Visualforce security, not modern client-side frameworks.
Projects that rely entirely on Salesforce's declarative tools like Flows or Process Builders, with minimal or no custom Apex code requiring security enforcement.
Organizations using third-party security scanning tools integrated into CI/CD pipelines, as ESAPI operates at the code level within Apex rather than providing external audit capabilities.

Pros & Cons

Pros

Comprehensive Input Validation

Provides both exception-based and boolean methods for validating untrusted input like credit card numbers directly in Apex, as shown in the README's getValidCreditCard and isValidCreditCard examples, preventing injection attacks.

Integrated Output Encoding

Encodes output for safe display in Visualforce pages using functions like SFDC_HTMLENCODE, equivalent to built-in Visualforce encoding but within Apex classes, ensuring consistent security in business logic.

User Context Access Control

Enforces Salesforce's CRUD, FLS, and Sharing models in Apex by allowing execution in user context, with methods like updateAsUser, preventing security bypasses in system mode as detailed in the access control example.

Detailed Exception Handling

Offers specific security exception messages via SFDCAccessControlException, with methods like getExceptionType() and getExceptionReason(), improving debugging and compliance reporting.

Cons

Manual Deployment Process

Requires downloading and uploading classes to the Force.com Org or using a one-click deployment link, which is cumbersome compared to modern package management or seamless Salesforce DX integrations.

Limited to Legacy Technologies

Primarily supports Apex and Visualforce, with no built-in integration for newer Salesforce frameworks like Lightning Web Components, reducing its relevance for contemporary UI development.

Sparse Documentation

The README directs users to a separate doc folder for detailed documentation, which may not be comprehensive or up-to-date, increasing the learning curve and reliance on community support.

Frequently Asked Questions

What is Force.com ESAPI?

Target Audience

Salesforce developers and administrators building custom Apex applications on the Force.com platform who need to implement robust security measures and comply with Salesforce security best practices.

Value Proposition

Use Cases

Best For

Validating untrusted user input in Apex controllers
Encoding output for safe display in Visualforce pages
Enforcing CRUD and FLS permissions in system context Apex code
Implementing sharing rule enforcement in custom Apex logic
Preventing injection attacks in Salesforce custom applications
Handling security exceptions with detailed error messages in Apex

Not Ideal For

Teams building applications primarily with Salesforce Lightning Web Components, as ESAPI is designed for Apex and Visualforce security, not modern client-side frameworks.
Projects that rely entirely on Salesforce's declarative tools like Flows or Process Builders, with minimal or no custom Apex code requiring security enforcement.
Organizations using third-party security scanning tools integrated into CI/CD pipelines, as ESAPI operates at the code level within Apex rather than providing external audit capabilities.

Pros & Cons

Pros

Comprehensive Input Validation

Integrated Output Encoding

User Context Access Control

Detailed Exception Handling

Offers specific security exception messages via SFDCAccessControlException, with methods like getExceptionType() and getExceptionReason(), improving debugging and compliance reporting.

Cons

Manual Deployment Process

Requires downloading and uploading classes to the Force.com Org or using a one-click deployment link, which is cumbersome compared to modern package management or seamless Salesforce DX integrations.

Limited to Legacy Technologies

Primarily supports Apex and Visualforce, with no built-in integration for newer Salesforce frameworks like Lightning Web Components, reducing its relevance for contemporary UI development.

Sparse Documentation

The README directs users to a separate doc folder for detailed documentation, which may not be comprehensive or up-to-date, increasing the learning curve and reliance on community support.

Frequently Asked Questions

Force.com ESAPI

What is Force.com ESAPI?

Overview

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions

Related Projects

Found a gem we're missing?

Force.com ESAPI

What is Force.com ESAPI?

Overview

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions

Related Projects

Found a gem we're missing?