Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-10-05 14:46:55 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 4
bcquality/microsoft/knowledge/security/recordref-open-with-caller-table-must-not-be-public.md
Jesper Schulz-Wedde 2b5550c346
Some checks failed
Validate knowledge index / validate-index (push) Has been cancelled
Details
Validate AL review fixtures / validate-review-fixtures (push) Has been cancelled
Details
Validate frontmatter and structure / validate (push) Has been cancelled
Details
Improve partner onboarding and documentation navigation (#174) 
Lead with a complete plugin quick start and add task-oriented usage, troubleshooting, customization, and contribution guides. Preserve the broader plugin framing, correct conflicting contract guidance, support Agents folder reviews, and align repository validation. Convert existing sample references to clickable links without changing knowledge rules.

Co-authored-by: Jesper Schulz-Wedde <jesper.schulzwedde@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2026-09-09 17:31:03 +02:00

2.1 KiB
Raw Permalink Blame History

bc-version domain keywords technologies countries application-area
all
security
recordref
open
public
system-table
scope-onprem
confused-deputy
saas
al
w1
all

Procedures that RecordRef.Open a caller-provided table must not be public

Description

When a codeunit holds permission to system tables — directly, via a permission set granted at install, or via [InherentPermissions] — and exposes a public procedure that accepts a table number (or a RecordId, from which the table number is derived) and calls RecordRef.Open on it, the procedure becomes a confused deputy. Any other extension on the same tenant can invoke the procedure with the table number of a system table the calling extension does not own permissions for and obtain access to its rows through the wrapper. This is especially acute in SaaS: an on-premises-style extension that holds broad permissions can be exploited by a co-tenant extension that calls its public surface.

Best Practice

Mark such procedures local (callable only inside the containing object), internal (callable only inside the owning extension), or [Scope('OnPrem')] (not callable from SaaS extensions). If the procedure must be public, validate the table number against an allow-list before RecordRef.Open — if not IsAllowedTable(RecId.TableNo) then Error(...) — so the caller cannot specify an arbitrary table. See sample: recordref-open-with-caller-table-must-not-be-public.good.al.

Anti Pattern

procedure ArchiveRecord(RecId: RecordId) (public by default) whose body calls RecRef.Open(RecId.TableNo) and then reads, modifies, or deletes the record. Reviewers should flag any procedure that is public (no local/internal/[Scope('OnPrem')]), takes a RecordId, Integer table number, or Variant as a parameter, and calls RecordRef.Open with that parameter — unless an allow-list check on the table number precedes the open. See sample: recordref-open-with-caller-table-must-not-be-public.bad.al.