6

My Managed package (yearly) Security Review failed with new issues I was not aware of and which I could not find documented anywhere, E.g.:

  • Stored XSS - "Avoid using escape=false unless absolutely necessary..."
  • JS not in Static Resource - "All non-Salesforce Javascript files must be included ..."

So here are my questions:

  1. Why don't those appear in my own Checkmarx / Security Scanner runs?
  2. Why don't those appear in the Sec Review Checklist documented in https://partners.salesforce.com/0693A000007QbpbQAC?
  3. Is there a complete and up-to-date list of everything that Salesforce is checking?
  4. Is there a way for ISVs to automatically check those rules BEFORE going into a SecRev?
3
  • 3
    Our last exchange on this subject with our SF account person was to use github.com/forcedotcom/sfdx-scanner and we are adding that to our CI process. But more likely similar rules rather than identical rules to Checkmarx.
    – Keith C
    Jan 4, 2021 at 13:00
  • 1
    That is funny. As the guy behind PMD that helped the team behind the scanner I love that Salesforce seems to move away from Checkmarx but to be honest no engine of the current scanner (PMD or ESLint can detect the most issues that Checkmarx finds). So at best its a forward looking suggestion. Jan 4, 2021 at 15:57
  • 2
    Re the new issues - I feel like I only know about them because I read about them in places like this where someone said ' but be careful doing that in packages - you'll fail SR if you do that' - and 100% agree that new requirements seem to be added each time I have to do a review that weren't an issue the previous time. Jan 4, 2021 at 16:15

1 Answer 1

1

Why don't those appear in my own Checkmarx / Security Scanner runs?

Possibly false negatives? It's hard to tell without seeing the code in question and the scanner results; you may need to log a bug with someone. Also, the SFDX Security Scanner is a suite of tools, but not necessarily as comprehensive as Checkmarx, and may also be out of date. Make sure all your packages are up to date if using the Security Scanner.

Why don't those appear in the Sec Review Checklist documented in https://partners.salesforce.com/0693A000007QbpbQAC?

I apparently can't access this, but the Security Review Submission Requirements Checklist Builder seems like the best option. Note that it asks for details about the project to filter out irrelevant rules.

Is there a complete and up-to-date list of everything that Salesforce is checking?

Yes (see the Builder).

Is there a way for ISVs to automatically check those rules BEFORE going into a SecRev?

What about Apex PMD, perhaps with custom Rules? In reality, I suspect that PMD is probably missing these because it doesn't scan non-Apex resources. The Checkmarx scanner should work, though, and again, I'd suggest logging a bug. Since Checkmarx is the official scanner for a Security Review, that's what you should be using. If you're paying for Checkmarx, see if there's an updated version you should be using by contacting their support team.

4
  • No they are not false positives but Rules that were never reported by Checkmarx. I cannot access you builder (strange). And...no PMD cannot fully replace Checkmarx as it checkes single files only and for security checks you need a broader picture. Jan 4, 2021 at 16:00
  • 1
    @RobertSösemann Not false positives, false negatives (items that were somehow missed in the scan). If you're not getting the same results as the official scanner, then some rules are broken somehow.
    – sfdcfox
    Jan 4, 2021 at 16:03
  • Now I found the "Builder" you mention but it's definitely not building a list of rules it checks for just a checklist of generic todos when I go into Security Review. Did I still miss something? Jan 5, 2021 at 12:18
  • I also created a separate question for one of the new issues. Maybe you can help there salesforce.stackexchange.com/q/330379/256 Jan 5, 2021 at 13:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .