AGENTFORCE-APEX-03: Unrestricted Guest or Agent File Upload
🔴 High · Broken Access Control
Detects Apex that inserts ContentVersion (or assigns VersionData / PathOnClient) from caller-controlled file name and bytes without a content-type or magic-byte allowlist. Guest and agent entry points that accept any payload the size gate allows enable malware and polyglot uploads into Salesforce Files.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-APEX-03 |
| Severity | High |
| Category | Broken Access Control |
| Compliance | SOC2_CC6, HIPAA |
Remediation
Validate uploads before insert: allowlist ContentType / file extension, verify magic bytes on VersionData, reject double extensions, and run the DML in USER_MODE. For Experience Cloud guest or agent-driven uploads, keep the allowlist in Apex (not only in the client).