All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry ...

learn more… | top users | synonyms

1
vote
2answers
17 views

How to JSENCODE from an apex controller?

I select a list of sObjects in my controller then pass directly to my visualforce page where I render out as a javascript object. I can't use JSENCODE in the visualforce page because I need the ...
0
votes
1answer
12 views

Alternative to String.escapeSingleQuotes to avoid XSS

I have a few places in my code that were flagged as "Stored XSS" and "Reflected XSS" respectively. Here's an example of a "Stored XSS" vulnerability: Database.query('select Id, Name, Email from ...
2
votes
1answer
22 views

Managed package API URL is different then unmanaged package?

After my app is granted an OAuth token by the user, I take the "url" provided in the OAuth request, and the token, and make a request back to salesforce to store some settings. In my unmanaged ...
1
vote
1answer
54 views

“Client Cross Frame Scripting Attack” flagged by Checkmarx scanner

I have a page where the users can click a link which opens a popup window to start the OAuth connection/flow. However this page is getting flagged by the Checkmarx scanner as a possible "Client Cross ...
3
votes
1answer
31 views

“Multiple Forms In Visualforce Page” caught by Checkmarx scanner

One of my pages was scanned by Checkmarx and it's returning this flag "Multiple Forms In Visualforce Page" Indeed in my page I have several form tags like so: <apex:outputPanel rendered="{! $...
0
votes
0answers
35 views

Cross-site Scripting(XSS) in apex component

I had submitted a app code for security review and got the Client Cross Frame Scripting Attack issue in apex component I have checked the code for the vulnerabilities and have no clue why this ...
0
votes
1answer
30 views

“Sharing With Controller” Vulnerability

I got a "Sharing with Controller" Vulnerability from the Checkmarx scan. It doesn't give many details though it only flags this line in my Visualforce page: <apex:page controller="...
4
votes
2answers
98 views

How to fix an FLS security vulnerability?

In my managed package I have a custom RestResource that looks something like this (simplified): @RestResource(urlMapping='/customsettings') global class setCustomSettings { CustomSetting__c ...
3
votes
2answers
36 views

Are ISV apps allowed to create unmanaged metadata dynamically?

I'm trying to create a developer tool for the AppExchange that is able to create unmanaged Apex classes dynamically (for example, after clicking a button in the app.) Does salesforce allow ISV apps ...
1
vote
1answer
17 views

How to use the security scanner when you need your code in a package?

I'm creating a package in a Developer Edition and there's a couple reasons why I want to keep all my components (apex code, visualforce pages, etc) in a package. It lets me subscribe to the ...
0
votes
0answers
9 views

Inserting a custom object with an auto number field using the ESAPI library

We are using Force.com ESAPI to secure our DML operations and we cannot insert new records of a custom object that has an auto-incrementing auto number because that field is read-only and ESAPI ...
3
votes
1answer
35 views

Lightning security on init page load with server-side call

I was reading through the Lightning Security documentation here and noticed one of the points for Cross Site Forgery. In order to prevent CSRF attacks, do not invoke any server-side controller ...
1
vote
2answers
126 views

“Instances of SELECT vulnerability found across the application” for CRUD/FLS in Security Review

We received a note from the security review team highlighting a CRUD/FLS vulnerability in our package and in the note it says there is a "Instances of SELECT vulnerability found across the application"...
1
vote
1answer
59 views

Is Jquery search allowed in Lightning component framework for Security Review

In our application we have a use case where we need to search elements using Jquery as following In the controller : var Id = 'groupInput'+component.get("v.comp_suffx"); var GroupInputVal = $("#"+...
0
votes
0answers
21 views

Will modify all access to an user in an app cause issues during Salesforce Security review?

I have an external system making SOAP calls to Salesforce through an Integration user who has modify all access in Salesforce. Will this cause issues during Salesforce Security review? Is it possible ...
2
votes
1answer
17 views

Do canvas applications need to go through security approval?

I've heard mixed things. If I have an app that primarily uses Salesforce Canvas to operate, is that required to go through the security review? Does it perhaps depend on if it's a managed package vs. ...
3
votes
1answer
19 views

What are some common reasons to fail a managed packaged security review?

Just looking for the top few things to watch out for. Can anyone recommend common mistakes or areas of concern?
1
vote
0answers
9 views

Security review with third party integration

I'm working on a managed package that we want to publish on the AppExchange. The application has an integration (using a webservice) with a third party application that is not related to Salesforce in ...
0
votes
0answers
37 views

Use Strict Transport Security (HSTS) with Salesforce

We are having a third party do security testing for our Salesforce community and one of their suggestions was to "utilize the "Strict-Transport-Security" response header across the entire domain as a ...
4
votes
1answer
51 views

How to store sensitive data in Salesforce (for AppExchange package)?

I am developing AppExchange package, it contains integration with third-party webservice. I store credentials to this webservice in custom settings. After security review I received an email with ...
4
votes
1answer
59 views

Are external iframes in lightning experience kosher from a security review perspective?

We are looking to embed an external page in lightning experience. I'm trying to understand if a canvas app or an iframe is the recommended approach from a security review perspective for our use-case. ...
3
votes
1answer
72 views

DOM modification feasibility in lightning

I want to implement Auto Compete in lightning, for this I have to use jQuery and jQueryUI and I have to directly modify DOM of component as well. Will it be allowed by the Salesforce ? Will is cause ...
2
votes
0answers
48 views

Firing event in renderer issue

I am using highcharts in my lightning components which is embedded in a lightning app. When clicking on the chart , I am firing an event. the method to draw the chart is called from renderer. And the ...
2
votes
0answers
31 views

Marketing cloud hubexchange app's security review

I recently hear the news that Salesforce is asking for the security review of hubexchange apps.I'm not sure this is only for security purpose or they are migrating the hubexchange apps to appexchange. ...
1
vote
1answer
42 views

Security Scan for remote site

Can you please help me running scan for a remote site setting. SFDC asked for chimera report for remote Site setting. eg. I have a remote site setting with URL as: https://abc.abc.com and which gets ...
4
votes
1answer
71 views

Stored XSS - Salesforce security check ( AngularJS) error

I am getting an error while security check Category : cross-site scripting , Stored XSS for below $scope.nameMap = {!nameMap}; For javaScript we have some encoding methos but i didn't found such ...
5
votes
2answers
36 views

What is the best way to include AES Encryption private key in a Managed App (with Security Review Passing)?

I'm trying to get an app pass Security Review, but the review team has identified that the key phrase being used is insecure storage mechanism. What I did was, I simply put the key in string ...
8
votes
1answer
124 views

Why is Security Review not passing app because of Weblinks containing JS code?

In latest development Salesforce Security Review team identified an issue with Javascript code in WebLinks. The exact statement that was provided in Security Report was: JavaScript of any type is ...
2
votes
1answer
46 views

Salesforce periodic security review process

I have a Salesforce App which passed security review for the first time in the last year. This App also includes integration with external web application, due to this I also submitted a BURP scan ...
1
vote
0answers
72 views

Error logging in to Chimera and got error. Please suggest

When we tried to logging in Chimera, but got the following error. We want to scan our code before security and technical review process. Please suggest. Problem Logging In We can’t log you in ...
0
votes
1answer
12 views

Change aesthetic things in an app package

Suppose I have an app ready to deploy to the AppExchange. It just passed the Security Review, but I see that there are minor changes like a field's, object's or tab's label/name. Such change could be ...
4
votes
0answers
75 views

How to Address DOM-based XSS from Security Review

I have a remoting function on my page that takes a list of contacts, and displays them in on Lightning Design styled page. It works fine, but the final innerHTML statement gets flagged in security ...
8
votes
2answers
419 views

What would really happen in the security review before listing our app in AppExchange?

we have developed an app that we are planning to list it in AppExchange. For that, we have completed AE meeting, first round of technical review with a Saleforce Technical Evangelist. Now, we are ...
1
vote
1answer
104 views

CRUD permission check Security Review with SOQL queries needed?

The CRUD permission check for Security Review has been imposed recently, though I'm clear on the DML statement and Create/Update/Delete permissions I need to check for in my code, but I'm not clear ...
2
votes
1answer
43 views

Security scan of salesforce gives 'Test Methods With No Assert' for doInvoke() method of WebServiceMock Interface

I got the security scan report, in that, they mentioned 'Test Methods With No Assert' for method 'doInvoke()' method of WebServiceMock Interface. The 'doInvoke()' is not test method but it is a mock ...
4
votes
2answers
169 views

XSS : Rich textarea content security review issue when using escape=false

I am getting user input through textarea as richtext and storing in object : <div class="col-md-12"> <div class="col-md-12"> <div class="form-group"> <...
1
vote
2answers
62 views

Alternatives for innerHTML in jQuery

This might seem a question not related to this forum. But, according to Salesforce Security reviews, we are not supposed to use innerHTML in our code. Since, this could cause Cross-Site-Scripting(...
7
votes
4answers
695 views

Genuine SOQL Injection issue or False Positive?

Trying to work out if this a valid issue with my code, or just a false positive I can note in report for Security Review. I have provided a slightly simplified version below. The Id I am querying for ...
1
vote
1answer
74 views

How to resolve Bulkify apex methods using collections in methods (Chckmarx issue)? [closed]

I have submitted my code for security review and got a few warnings for the Bulkify Apex Methods Using Collections In Methods. I have read the code best practices and also some stack exchange posts ...
2
votes
1answer
49 views

Security Review Scanner help

I ran the checkmarx security scanner and I got 1 item flagged as a "Bulkify Apex Methods" but I'm not 100% sure I get what's the issue there. Here's a screenshot of the Checkmarx issue. Can you ...
3
votes
1answer
175 views

List of Low risk level issues that can be ignored with ZAP scanner

Are there any issues that can be ignored from ZAP scanner results? I know there is a thread here on issues that can be ignored in BURP suite here. However, those issues are informational, but those ...
6
votes
1answer
919 views

Lightning Components Do NOT Use React?

The combination of Lightning Component and React is NG? Is my understanding of this correct? https://developer.salesforce.com/page/Requirements_Checklist Use of third party MV * frameworks is not ...
1
vote
1answer
21 views

Salesforce Security - Identifying vulnerabilities

I have completed a review of the following aspects of our organization a) Authentication b) Verifying profile based permissions are inline c) IP restrictions d) Timeout on unattended sessions e) ...
1
vote
1answer
68 views

Salesforce Security Review Error - Possible XSS / escape='false'

Salesforce Security Review Error - Possible XSS / escape='false' : How to solve this issue for the below set of line $calEvent.find(".wc-time").html(calEvent.status+"<br/> <div style='font-...
4
votes
1answer
119 views

Security concerns around site.login() StartURL parameter

I was reading An Insiders Guide to Security Review and on page 17, point 10 noticed something called Unvalidated Redirects and Forwards. The jist here is that user might be redirected to malicious ...
0
votes
1answer
33 views

Data Requirements for Security Review to test Web Services in a package

I have a package that I am trying to get through security review. The package is really an API layer that other packages rely on, so it doesn't have a UI you can submit calls through - just global ...
6
votes
2answers
1k views

How Checkmarx works

Can someone please advise how Checkmarx/ Force.com Security Source Scanner will be performing code review Is code review happening within Salesforce servers or code get ported to Checkmarx server ...
1
vote
1answer
67 views

Already released Managed Package to AppExchange

I'm a bit overwhelmed by the amount of information on publishing apps to AppExchange. Could please someone clairify how the following scenarios would go? Let's suppose that our clients are using our ...
1
vote
1answer
50 views

What is the meaning of this error message?

I got an unmanaged package from the developer. I installed it in the developer org. Created a managed package from the components and gave the managed package for security review. Here is the message ...
2
votes
1answer
219 views

Security review sample “False positive document”

We are submitting our app for security review. We have an ASP.Net web application that consumes few Salesforce APIs. The Burp scanner raised few OS, Ruby, Python and PHP injection errors. But we don't ...