Timeline for Why is Security Review not passing app because of Weblinks containing JS code?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 8, 2016 at 11:48 | comment | added | VarunC | Abhijeet, we had scheduled a meeting with Security Review's Office Hours team member. We reviewed and discussed various steps we could take to get our app security reviewed. The JS button/weblinks were also part of that. Our app was passing lot of parameters in those buttons. But the concern raised by the team was xss injection occurring by text fields or doing some location.url or redirect as retUrl parameter, so ultimately, it was confirmed to us that if we make sure that we only pass record ID field in weblink content then we are good to go. You should also hold same discussion with them | |
| Aug 8, 2016 at 8:20 | comment | added | Abhijeet | Hi Varun- for the managed package in my case, we have multiple JS buttons on the record detail page and we are performing some logic by fetching id from URL like '{!Custom object__c.Id}'"); Currently, i have not encoded it.Just want to you will this also fall under vulnerability category and if yes, jusy by encoding it we can get rid of it right? Please let me know ur understanding if we can actually solve this | |
| Aug 4, 2016 at 7:12 | comment | added | VarunC | I may have been lucky then. After our review meeting we agreed on a common consensus that we can have weblinks with javascript as source but we should limit url parameters to only id values. | |
| Aug 4, 2016 at 7:08 | history | answered | Abhijeet | CC BY-SA 3.0 |