System, method and computer program product for rendering data of an on-demand database service safe

• US 8,782,785 B2
• Filed: 12/17/2012
• Issued: 07/15/2014
• Est. Priority Date: 07/19/2007
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Casalaina, Marco S., Dominguez, Frank Jr., Debaty, Philippe G. D., Fly, Robert
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US13/717,539
• Publication Number:
  US 20130111585A1
• Time in Patent Office: 575 Days
• Field of Search: 726 22- 25, 707/690, 707/692
• US Class Current: 726/22
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

In accordance with embodiments, there are provided mechanisms and methods for rendering data of an on-demand database service safe. These mechanisms and methods for rendering on-demand database service data safe can enable embodiments to alleviate any security risk that would otherwise be posed by such data. The ability of embodiments to provide such additional safety may lead to improved security in the context of an on-demand database service.

Claims

1. A method, comprising:

identifying data belonging to a tenant in a database of an on-demand database service, the data capable of being displayed to a user of the on-demand database service, the data including at least one code, the data being associated with a field of the database of the on-demand database service;

analyzing, utilizing a process of the on-demand database service, the at least one code of the data stored in the database of the on-demand database service to identify whether the at least one code poses a security risk;

rendering the data safe, at least in part, by removing the at least one code identified to pose the security risk, utilizing a hardware processor; and

storing the data and the data rendered safe to enable the data and the data rendered safe to be synchronized in response to an update request associated with one of the data and the data rendered safe.

2. The method of claim 1, wherein the data includes a document.

3. The method of claim 1, wherein the data includes customer relationship management data.

4. The method of claim 1, wherein the data is identified after being received over a network.

5. The method of claim 1, wherein the analyzing and the rendering are performed by a server of the on-demand database service.

6. The method of claim 1, wherein the at least one code includes at least one mark-up language tag.

7. The method of claim 1, wherein the analyzing includes comparing the at least one code against at least one entity for identifying whether the at least one code poses the security risk.

8. The method of claim 7, wherein the entity includes a whitelist.

9. The method of claim 7, wherein the entity includes a blacklist.

10. The method of claim 7, wherein the entity includes a pattern.

11. The method of claim 1, wherein the analyzing includes parsing the at least one code.

12. The method of claim 1, wherein a spell check function is performed in parallel with the analyzing.

13. The method of claim 1, and further comprising determining whether a security feature is enabled by a user, and conditionally performing the rendering based on the determination.

14. The method of claim 1, and further comprising determining whether predetermined functionality is enabled, wherein the data is conditionally rendered safe based on the determination.

15. The method of claim 14, wherein the functionality includes at least one of spell check functionality, electronic messaging functionality, search engine functionality, reporting functionality, exporting functionality, and listing functionality.

16. A non-transitory machine-readable medium carrying one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to carry out the steps of:

identifying data belonging to a tenant in a database of an on-demand database service, the data capable of being displayed to a user of the on-demand database service, the data including at least one code, the data being associated with a field of the database of the on-demand database service;

analyzing, utilizing a process of the on-demand database service, the at least one code of the data stored in the database of the on-demand database service to identify whether the at least one code poses a security risk;

rendering the data safe, at least in part, by removing the at least one code identified to pose the security risk; and

storing the data and the data rendered safe to enable the data and the data rendered safe to be synchronized in response to an update request associated with one of the data and the data rendered safe.

17. An apparatus, comprising:

a processor; and

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

identifying data belonging to a tenant in a database of an on-demand database service, the data capable of being displayed to a user of the on-demand database service, the data including at least one code, the data being associated with a field of the database of the on-demand database service;

analyzing, utilizing a process of the on-demand database service, the at least one code of the data stored in the database of the on-demand database service to identify whether the at least one code poses a security risk;

rendering the data safe, at least in part, by removing the at least one code identified to pose the security risk; and

storing the data and the data rendered safe to enable the data and the data rendered safe to be synchronized in response to an update request associated with one of the data and the data rendered safe.

18. A method, comprising:

identifying data belonging to a tenant in a database of an on-demand database service, the data capable of being displayed to a user of the on-demand database service, the data including at least one code, the data being associated with a field of the database of the on-demand database service;

analyzing, utilizing a process of the on-demand database service, the at least one code of the data stored in the database of the on-demand database service to identify whether the at least one code poses a security risk;

rendering the data safe by selecting, based at least in part upon whether the at least one code poses a security risk, one of the data and a copy of the data having the at least one code removed, utilizing a hardware processor; and

storing the data rendered safe in the database of the on-demand database service.