All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry ...

learn more… | top users | synonyms

1
vote
1answer
12 views

Salesforce: Security Review- Second Organization

A quick question on the security review process, I have everything set up and running on the original developer organization, the publisher portion of it is good. I have no issues outstanding with the ...
1
vote
1answer
14 views

Managed Base and Extension Packages and the AppExchange: How to deal with Licenses and Security Reviews

A recent question had basically two different answers regarding the usage of features, which might not be available at the target org: Adress the feature in question in a soft way. E.g. use the ...
2
votes
0answers
23 views

CRUD and FLS enforcement

I have an Account list and I want to update it. I want to testing object and field level security enforcement but I'm wondering what I have to test : 1 - if Account object is updatable ? (if it's ...
0
votes
1answer
27 views

Changing callback url in connected app & security review

We have created managed package and submitted it for security review. We are using connected app to push data into SFDC from our web application. Right now its integrated with our QA site. e.g. ...
2
votes
2answers
71 views

How to write comments in APEX classes?

I'm wondering if there is a standard to write comments in APEX ? In order to pass the Security Review, I review my code. And I think writing good comments in APEX classes can help the reviewers to ...
3
votes
2answers
41 views

How to manage packages and extension packages

I want to deploy an application on the AppExchange and I need some explanations. My application contains several editions (Edition 1, 2, 3 and 4) with differents features. Superior edition contains ...
1
vote
1answer
53 views

How to run Burp web scanner for HTTP Callout?

I have submitted app for security review and they asked for Burp Scan Report. I have followed video tutorial but not get succeeded. Burp Scanner scan salesforce site instead of my HTTP Callout. ...
3
votes
2answers
381 views

Burp Scanner in Salesforce

Salesforce have asked me to do a BURP Scan on my managed package before I submit it to the AppExchange. My Managed Package is built on the Force.com platform. It does perform a couple of callouts to ...
1
vote
0answers
26 views

Custom javascript is not allowed to run on Salesforce DOM [duplicate]

Recently i have created an app which uses custom JavaScript in sidebar home page component using custom links, The app works perfectly and i also uploaded it to appexchange as managed released package ...
2
votes
1answer
34 views

How to Use Custom Setting to Avoid Insecure Credential Storage Vulnerability?

I got a comment from Salesforce team about an insecure credential storage vulnerability saying that we must avoid hardcoding sensitive information and should use the custom settings. My situation ...
0
votes
1answer
46 views

Salesforce checkmarx security scan

Recently I put my code through the free checkmarx code scanner provided by salesforce. It gave me a stored XSS issue. But the piece of code which was identified has been in my codebase since a long ...
2
votes
1answer
24 views

new app still counting against object/tabs

New managed package just passed security review, tried installing into a test org and it still counts against object/tab limits in the org. Also still getting the notice when installing the app: ...
3
votes
1answer
70 views

Security Review - False Positive Document

I want to submit my app for security review. Since my App is calling some external API security review wizard is prompting to provide below details. Burp Scan report False positive document I have ...
4
votes
1answer
134 views

Direct API Calls from Visualforce Page

I am finding it pretty exciting to make webservice calls directly from visualforce + javascript. Specially with frameworks like Angular, you can directly consume JSON and render HTML templates pretty ...
1
vote
1answer
77 views

Tooling API and Scheduled Batch Apex - How to access

Without storing a users credentials to salesforce how can one access the tooling API during a daily scheduled batch? Currently we are storing the users username and password in encrypted fields but ...
1
vote
2answers
60 views

How to BURP test our outbound msg endpoint?

We are using some workflows and trigger to send out outbound msgs to a listening end-point of ours. We are going into a security review with SF and that requires some testing using BURP.. What I have ...
2
votes
2answers
87 views

How do I fix this Stored XSS?

The CheckMarx security scanner says that this line is a Stored XSS vulnerability <apex:column style="background-color:#{!trade.bgcolor};color:{!trade.fgcolor};"> is this HTMLENCODE the ...
1
vote
2answers
126 views

How do I fix this Reflected XSS vulnerability?

The CheckMarx security scanner says that this line is a Reflected XSS vulnerability. <apex:outputText value="0,number,#,##0.00}" style="color:!nost.balColor};"> However this page ...
4
votes
1answer
167 views

Get a FIRST-CLASS SessionID for API Calls (looking for a clean way or alternative)

I am basically facing the same challenge as @Evan here Different Session Ids in Different contexts I'm also running into SessionID related issues, but in a completely different use case. Background ...
1
vote
2answers
208 views

How do I fix this Stored XSS vulnerability?

The CheckMarx security scanner says that the 4th line: $j('#h{!category}').on('click', function(event) { in the following script, causes an XSS vulnerability. Can someone explain the best way to ...
0
votes
0answers
31 views

Push Major Upgrades before Security Review possible?

After logging a case to get Push Major enabled the Support refused it. They say its only available after security review. This beside of the lack of documentation this makes only halfway sense to ...
12
votes
3answers
511 views

How to pass security review when using “Without sharing” by design?

I failed to pass security review for an app that has two classes using the "without sharing" keyword. Both were not choosen accidentally but by design. On class is SObjectUnitOfWork.cls from Andrew ...
5
votes
1answer
107 views

Why did I fail Security Review when not checking FLS or using “without sharing”?

I submitted a package for security review which has a Custom Object which has internal / technical semantics only. So it's not created or even seen by users. When a user performs some action some ...
9
votes
2answers
93 views

Rolling back a managed released package?

We have a managed released package currently undergoing security review. While that is happening, we would like to make some changes to the tab layout of our application. Unfortunately, it seems that ...
6
votes
1answer
106 views

How to set a custom setting value in a managed package securely?

My application uses an authorization key stored in a protected custom setting to authenticate users to connect to an external web service. Since you can't define a default value on package install for ...
5
votes
0answers
37 views

Mini Page Layout Hovers in Managed Package

Has anyone using the mini page layout popup technique listed here in a managed package had the package rejected in security review because of it? This is obviously an unsupported technique, but given ...
8
votes
1answer
52 views

Metadata API usage in a managed package

If I have Apex code in my managed package that makes calls to the metadata API of the org in which it is installed to do various things, e.g. describe page layouts, create Visualforce pages based on ...
1
vote
2answers
67 views

Salesforce security review

I am new to salesforce development and have a question regarding the application security review process. After the installation of my application in salesforce I want to invoke a service in my java ...
3
votes
0answers
91 views

Security Scanner finds XSS False Positives / JSENCODE incompatible with Boolean fields?

Before I submit my app for Security Review I checked it with the free scanner. It marked the following line of JS-code in a Visualforce as Critical XSS vulnerability: <script>var trueOrFalse = ...
1
vote
1answer
52 views

Security Review Step 5 issue

I've reached Step 5 of the Security Review submission for my new Managed Package. I've created a new Developer Org, installed the package and then proceeded to continue with the review. At step 5, ...
6
votes
1answer
138 views

Anyone have examples of genuine security issues identified by the Burp Scanner for external web services called via Apex?

Thanks to this blog post Using the Burp Suite to test a Web Service that is consumed in a Salesforce app I believe I have successfully scanned the two web services that my managed package calls. (This ...
4
votes
1answer
109 views

“inputText_Ignoring_FLS” in force security scanner report

I scan my code, and I received a Serious issue: <apex:inputText value="{!ld.Name}" /> I have applied FLS as the guide here : http://wiki.developerforce.com/page/Enforcing_CRUD_and_FLS ...
4
votes
2answers
161 views

SalesForce Package Distribution Scenarios

I am writing an adapter for SalesForce which functionality will be to post information about particular events happened in the CRM to the external WebService. While I think I understood development ...
13
votes
1answer
454 views

How does Salesforce classify an app as 'Salesforce1 ready'?

As part of the Salesforce1 announcement, Salesforce showcased a list of apps on AppExchange that are 'Salesforce1 ready'. This includes several popular apps such as Box, Concur etc. I want to know how ...
4
votes
1answer
224 views

Security review for free apps in appexchange

We have created one app and planning to list in appexchange as free app. Do we need to pass security review, if yes then is it free or paid?. We have partner developer org to list in Appexchange.
11
votes
1answer
493 views

BURP Scanning a managed package

Salesforce have asked me to do a BURP Scan on my managed package before I submit it to the AppExchange. My Managed Package is built on the Force.com platform. It does perform a couple of callouts to ...
4
votes
2answers
878 views

Managed app installation on Salesforce Production Org

Salesforce has two versions of Managed app Managed App ( Beta ) Managed App ( Released ) Currently inorder to do a prototype testing I released a Managed App (Beta) and simulated how a real ...
1
vote
0answers
87 views

SF Security Review Questioner - single org solution vs hybrid single org solution

I came across this question in Salesforce Security Review Process. But I am not sure what to choose. Is your offering a single org solution of hybrid single org solution? Options: A : ...
2
votes
1answer
102 views

Free App for Paid Service

I'm working on getting an app listed on the AppExchange, and we are just about ready to go into the Security Review. We were wondering if it is going to be a problem that we sell our app for free on ...
1
vote
1answer
528 views

Cross-site Scripting (XSS) in security review.?

I am getting Cross-site Scripting (XSS) while scanning in force.com scanner.if i remove javascript there is no error..what to change in javascript code..please help its quite urgent...may be encode ...
2
votes
2answers
217 views

XSRF issue in security review..?

I am getting these from URL..when i submitted my app for security review. their report has XSRF error can some help me how to correct this...as i need to oid from the url.i could find any ...
7
votes
4answers
453 views

Cross-Site Request Forgery (CSRF) CWE

I have Following page: <apex:page controller="myclass" action={!clean}> </apex:page> and controller class as: public with sharing class myclass { public void clean() { ...
3
votes
1answer
398 views

Drag & Drop Upload Images to documents - Security Problems

We have developed a Drag & Drop multiple Image Upload with Html5, jQuery and the REST API. We are wondering what are the problems that this feature can bring up in the security review. Let me ...
0
votes
1answer
94 views

Running ApexClasses in PE with Security Review and Certification

I've a managed package which I would like to be installed in a Professional Edition. When I try to install the package in the PE, I get following error, of course my package has few ...
10
votes
2answers
121 views

Incomplete code blocks vulnerability

I've submitted my application for Security Review and I've got this problem in the report. I'm not sure how to fix it. Let's see the First case: I have some classes that don't have any code like ...
1
vote
1answer
601 views

How do I run burp scanner

How do I run burp scan? Do I have to buy a burp suite? What is partner license mentioned in this url?
2
votes
2answers
194 views

Sign up for partner portal

Creating partner portal is free. Please correct me if I am wrong. I want to start security review for a free application from my AppExchange profile but I can't do that before paying to salesforce. Is ...