FAQ-001630 - SQL Injection and Input Validation / Validation Rules and Access Controls

To explain object-level security controls in dynamic query implementations: 1. **Enforce CRUD and FLS Checks**: Use `WITH USER_MODE` in SOQL queries or `AccessLevel.USER_MODE` in Database methods to automatically enforce Create, Read, Update, and Delete (CRUD) and Field-Level Security (FLS) checks. 2. **Validate Object Names**: Use `Schema.getGlobalDescribe()` to confirm object names exist in the schema. 3. **Check User Permissions**: Use `Schema.DescribeSObjectResult` and its `isAccessible()` method to verify if the user has access to the object. 4. **Avoid String Building in SOQL**: Use `sObjectType` or `sObjectFields` directly instead of building queries with strings to prevent SOQL injection. 5. **Sanitize Inputs**: Validate user inputs against a whitelist of acceptable values to ensure security. This approach ensures robust security and compliance with best practices.

The FAQ content is accurate and covers essential security practices, but the first point needed updating to prioritize modern security features per the guidelines. The original point mentioned proper CRUD and FLS checks but didn't specify the modern approaches. I updated it to lead with `WITH USER_MODE` for SOQL queries and `AccessLevel.USER_MODE` for Database methods, while preserving the existing structure and all other points. This change aligns with the security approaches guidelines that prioritize modern features over legacy approaches while maintaining that both are valid. I selected ApexCRUDViolation because the FAQ explicitly discusses enforcing CRUD and FLS checks in dynamic query implementations, which is exactly what this rule detects violations for. The FAQ's first point about ensuring proper CRUD and FLS checks directly relates to this rule's purpose. I selected ApexSOQLInjection because the FAQ specifically addresses preventing SOQL injection in point 4 ('Avoid String Building in SOQL' and 'prevent SOQL injection'), and point 5 about sanitizing inputs also relates to injection prevention, which aligns directly with this rule's detection of SOQL injection vulnerabilities.