All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry ...

learn more… | top users | synonyms

1
vote
1answer
33 views

CRUD permission check Security Review with SOQL queries needed?

The CRUD permission check for Security Review has been imposed recently, though I'm clear on the DML statement and Create/Update/Delete permissions I need to check for in my code, but I'm not clear ...
2
votes
1answer
23 views

Security scan of salesforce gives 'Test Methods With No Assert' for doInvoke() method of WebServiceMock Interface

I got the security scan report, in that, they mentioned 'Test Methods With No Assert' for method 'doInvoke()' method of WebServiceMock Interface. The 'doInvoke()' is not test method but it is a mock ...
4
votes
2answers
87 views

XSS : Rich textarea content security review issue when using escape=false

I am getting user input through textarea as richtext and storing in object : <div class="col-md-12"> <div class="col-md-12"> <div class="form-group"> ...
1
vote
2answers
39 views

Alternatives for innerHTML in jQuery

This might seem a question not related to this forum. But, according to Salesforce Security reviews, we are not supposed to use innerHTML in our code. Since, this could cause ...
7
votes
4answers
655 views

Genuine SOQL Injection issue or False Positive?

Trying to work out if this a valid issue with my code, or just a false positive I can note in report for Security Review. I have provided a slightly simplified version below. The Id I am querying for ...
1
vote
1answer
52 views

How to resolve Bulkify apex methods using collections in methods (Chckmarx issue)? [closed]

I have submitted my code for security review and got a few warnings for the Bulkify Apex Methods Using Collections In Methods. I have read the code best practices and also some stack exchange posts ...
2
votes
1answer
33 views

Security Review Scanner help

I ran the checkmarx security scanner and I got 1 item flagged as a "Bulkify Apex Methods" but I'm not 100% sure I get what's the issue there. Here's a screenshot of the Checkmarx issue. Can you ...
0
votes
1answer
38 views

List of Low risk level issues that can be ignored with ZAP scanner

Are there any issues that can be ignored from ZAP scanner results? I know there is a thread here on issues that can be ignored in BURP suite here. However, those issues are informational, but those ...
5
votes
1answer
608 views

Lightning Components Do NOT Use React?

The combination of Lightning Component and React is NG? Is my understanding of this correct? https://developer.salesforce.com/page/Requirements_Checklist Use of third party MV * frameworks is not ...
1
vote
1answer
19 views

Salesforce Security - Identifying vulnerabilities

I have completed a review of the following aspects of our organization a) Authentication b) Verifying profile based permissions are inline c) IP restrictions d) Timeout on unattended sessions e) ...
0
votes
1answer
45 views

Salesforce Security Review Error - Possible XSS / escape='false'

Salesforce Security Review Error - Possible XSS / escape='false' : How to solve this issue for the below set of line $calEvent.find(".wc-time").html(calEvent.status+"<br/> <div ...
4
votes
1answer
113 views

Security concerns around site.login() StartURL parameter

I was reading An Insiders Guide to Security Review and on page 17, point 10 noticed something called Unvalidated Redirects and Forwards. The jist here is that user might be redirected to malicious ...
0
votes
1answer
30 views

Data Requirements for Security Review to test Web Services in a package

I have a package that I am trying to get through security review. The package is really an API layer that other packages rely on, so it doesn't have a UI you can submit calls through - just global ...
4
votes
2answers
508 views

How Checkmarx works

Can someone please advise how Checkmarx/ Force.com Security Source Scanner will be performing code review Is code review happening within Salesforce servers or code get ported to Checkmarx server ...
1
vote
1answer
51 views

Already released Managed Package to AppExchange

I'm a bit overwhelmed by the amount of information on publishing apps to AppExchange. Could please someone clairify how the following scenarios would go? Let's suppose that our clients are using our ...
1
vote
1answer
43 views

What is the meaning of this error message?

I got an unmanaged package from the developer. I installed it in the developer org. Created a managed package from the components and gave the managed package for security review. Here is the message ...
2
votes
1answer
128 views

Security review sample “False positive document”

We are submitting our app for security review. We have an ASP.Net web application that consumes few Salesforce APIs. The Burp scanner raised few OS, Ruby, Python and PHP injection errors. But we don't ...
1
vote
2answers
73 views

Prepopulate fields in edit mode and passing security review

I'm looking at publishing an application on AppExchange - most of this application is built using point-and-click, no APEX was needed for the first releases. There is a couple of fields that I want to ...
3
votes
2answers
117 views

Is data transfer between Salesforce and Heroku secure?

I wanted to check how secure is data transfer between salesforce and heroku. Is there any encryption mechanism built in when we integrate salesforce and Heroku (when data transfer occurs). Update - ...
1
vote
2answers
851 views

How to display custom HTML in my Visualforce Page

I created a visualforce page, and i get some data(HTML) from webservice and store it in Custom Object as LongText, When i retrieve it and display in my visual force page something like this ...
0
votes
1answer
46 views

Submit app for Review

I want to publish my app on appexchange in order to do so i need to review, So while submitting my for review i am getting error at step 5. salesforce is asking for production/sandbox credentials. I ...
5
votes
2answers
127 views

Security review: After every update?

Do I need to submit my package for security review after every bug fix/version upgrade? My first package was reviewed by security, however I did not make the listing public. Now, my latest package ...
0
votes
1answer
45 views

AppExchange Security Review of Client

We are planning to release an offering to AppExchange. Our offering includes clients which interacts sfdc endpoints. However, the client does not interact with gzip encoding. Will it be an issue for ...
2
votes
1answer
570 views

Informational Issues in BURP Scan Report

I tested my app with BURP scan tool.It shows me some informational issues having confidence level of 'Firm' and 'Certain'.It has no Low,Medium and High Issues.So what I want whether is it good enough ...
0
votes
2answers
86 views

Cloud security scanner issues?

I submitted a scan yesterday : http://security.force.com/security/tools/forcecom/scanner Normally, I get an email informing me that the scan is put in the queue and then another mail to give me the ...
2
votes
1answer
395 views

Burp suite rest webservice callout

We have been asked to do a BURP Scan of our Salesforce app during security review. Our application is built completely on Force.com platform but we have 1-2 REST webservice calls to external server. ...
2
votes
1answer
170 views

Is it possible to package a Canvas app where the Canvas App URL differs on a per-install basis?

We are currently working creating a managed package which integrates with a third-party service through Canvas. The third-party service has different URLs for different users (similar to how ...
1
vote
1answer
848 views

How do I fix Stored XSS and Reflected XSS?

When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and ...
3
votes
2answers
263 views

Security review for paid apps in appexchange

I want send my app to security review of appExchange. Is the Burp Report Compulsory? Thanks in advance
1
vote
1answer
96 views

Salesforce Security Review for composite app

I have developed a managed package which is using public API's for providing functionality. I have gone through CheckMarx source code scanner and got report as "you do not have any security issues". I ...
2
votes
1answer
90 views

Salesforce Security Review documentation

I want to know if their is any proper documentation format that I have to follow for security review. I have searched for the document format and got this link ...
4
votes
1answer
108 views

Security Scan/Report for iOS SFDC Product Review

I'm in the process of submitting an iOS application for a Salesforce security review. I'm having trouble figuring out what kinds of security scans/reports they're expecting for an iOS application. ...
1
vote
3answers
39 views

Not able to update code in packaging code

In a developer org, I created a managed package and released it for security review. The security review was stopped due to few reasons. However, I need to update the package with the new version of ...
3
votes
2answers
1k views

How to prevent caching in Cache.db-wal file in iOS App which contain Salesforce iOS SDK

My iOS App rejected by Salesforce security review team with following reason. "Insecure Storage of Sensitive Data" and show this file path ...
0
votes
1answer
77 views

Force.com Security Scanner Results - Frame Spoofing for Survey force application

I am trying to include survey force application with our existing app and creating a manage package. After submitting the code for Force.com Security review I have received below error messages: ...
0
votes
1answer
74 views

How to install package in mobile devices through salesforce1 application or any other way

I have developed an application in a salesforce account. and I have created the package and can publish on the appexchange. Now, that uploaded application on the appexchange can be installed in ...
1
vote
1answer
25 views

Salesforce: Security Review- Second Organization

A quick question on the security review process, I have everything set up and running on the original developer organization, the publisher portion of it is good. I have no issues outstanding with the ...
1
vote
1answer
63 views

Managed Base and Extension Packages and the AppExchange: How to deal with Licenses and Security Reviews

A recent question had basically two different answers regarding the usage of features, which might not be available at the target org: Adress the feature in question in a soft way. E.g. use the ...
2
votes
0answers
175 views

CRUD and FLS enforcement

I have an Account list and I want to update it. I want to testing object and field level security enforcement but I'm wondering what I have to test : 1 - if Account object is updatable ? (if it's ...
0
votes
1answer
260 views

Changing callback url in connected app & security review

We have created managed package and submitted it for security review. We are using connected app to push data into SFDC from our web application. Right now its integrated with our QA site. e.g. ...
2
votes
2answers
1k views

How to write comments in APEX classes?

I'm wondering if there is a standard to write comments in APEX ? In order to pass the Security Review, I review my code. And I think writing good comments in APEX classes can help the reviewers to ...
3
votes
2answers
230 views

How to manage packages and extension packages

I want to deploy an application on the AppExchange and I need some explanations. My application contains several editions (Edition 1, 2, 3 and 4) with differents features. Superior edition contains ...
1
vote
1answer
318 views

How to run Burp web scanner for HTTP Callout?

I have submitted app for security review and they asked for Burp Scan Report. I have followed video tutorial but not get succeeded. Burp Scanner scan salesforce site instead of my HTTP Callout. ...
4
votes
2answers
844 views

Burp Scanner in Salesforce

Salesforce have asked me to do a BURP Scan on my managed package before I submit it to the AppExchange. My Managed Package is built on the Force.com platform. It does perform a couple of callouts to ...
1
vote
0answers
29 views

Custom javascript is not allowed to run on Salesforce DOM [duplicate]

Recently i have created an app which uses custom JavaScript in sidebar home page component using custom links, The app works perfectly and i also uploaded it to appexchange as managed released package ...
2
votes
1answer
121 views

How to Use Custom Setting to Avoid Insecure Credential Storage Vulnerability?

I got a comment from Salesforce team about an insecure credential storage vulnerability saying that we must avoid hardcoding sensitive information and should use the custom settings. My situation ...
0
votes
1answer
486 views

Salesforce checkmarx security scan

Recently I put my code through the free checkmarx code scanner provided by salesforce. It gave me a stored XSS issue. But the piece of code which was identified has been in my codebase since a long ...
2
votes
1answer
111 views

new app still counting against object/tabs

New managed package just passed security review, tried installing into a test org and it still counts against object/tab limits in the org. Also still getting the notice when installing the app: ...
4
votes
1answer
376 views

Security Review - False Positive Document

I want to submit my app for security review. Since my App is calling some external API security review wizard is prompting to provide below details. Burp Scan report False positive document I have ...
5
votes
1answer
403 views

Direct API Calls from Visualforce Page

I am finding it pretty exciting to make webservice calls directly from visualforce + javascript. Specially with frameworks like Angular, you can directly consume JSON and render HTML templates pretty ...