Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-08-07 18:06:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Sync knowledge articles with review agent instructions

Browse source 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Jesper Schulz-Wedde 2026-05-05 14:08:32 +02:00
parent f562fba837
commit 5bcdc55df9
62 changed files with 768 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

26
microsoft/knowledge/security/keep-recordref-open-callers-non-public.md Normal file
View file

@ -0,0 +1,26 @@
---
bc-version: [all]
domain: security
keywords: [recordref, recordid, table-no, scope, inherentpermissions]
technologies: [al]
countries: [w1]
application-area: [all]
---
# Keep caller-driven RecordRef.Open procedures non-public
## Description
A codeunit can hold permissions or `InherentPermissions` that its callers do not have. If it exposes a public procedure that accepts a table number or RecordId and calls `RecordRef.Open`, another extension can call that procedure to make the privileged codeunit open tables on its behalf. That turns a generic helper into a permission-bypass surface, especially for system tables.
## Best Practice
Procedures that call `RecordRef.Open` with a caller-provided table number must be `local`, `internal`, or `[Scope('OnPrem')]`. If the procedure truly must be public in SaaS, validate the table number against a narrow allowlist before opening the RecordRef.
See sample: `keep-recordref-open-callers-non-public.good.al`.
## Anti Pattern
A public helper such as `ArchiveRecord(RecId: RecordId)` that opens `RecId.TableNo` and then reads, modifies, or deletes through RecordRef. The helper compiles, but it lets untrusted callers choose which table the privileged code opens.
See sample: `keep-recordref-open-callers-non-public.bad.al`.