Insecure Storage of Sensitive Data Vulnerability for a security review

Question

We have received this issue in our security review "Insecure Storage of Sensitive Data Vulnerability ".

I am making a call to external service to get a encrypted claim that i am using to login into a iframe.

We are not storing any sensitive information in salesforce. Only place where we are storing this encrypted claim is in js variable.

Is this false positive or i am missing something here.

Here is HTML code

<form id="helperForm" target="name" method="post" action= {hostUrlLogin}>
                    <input id="targetUrl" type="hidden" name="targetUrl" value={targetUrl}/>
                    <input id="ssoProvider" type="hidden" name="ssoProvider" value={ssoProvider}/>
                    <input id="encryptedClaims" type="hidden" name="encryptedClaims" value={encryptedClaim}/>
                </form>

Js code

    Promise.all([
            getAnalyticsSetting({
                customDashboard : this.dashboardId,
                recordId: this.recordId
            }),
            getPGPKey()
        ]).then(data => {
            if(data[0] && data[1]){
                this.encryptedClaim = data[1];
                this.targetUrl = data[0].url;
                this.iframeHeight = data[0].dashboardHeight;
                this.hostUrlLogin = data[0].hostUrl + 'xxxxx';
                this.template.querySelector("form").submit();
                // some logic to show dashboard.
            } else if(!data[0]){
                this.analyticsSetingPresent = false;
            }
        })

and apex code

@AuraEnabled
public static string getPGPKey(){
    try {
        Http http = new Http();
        HttpRequest request = new HttpRequest();
        request.setEndpoint('xxxxxx');
        request.setMethod('POST');
        request.setHeader('x-api-key', 'xxxxxx');
        request.setHeader('content-type', 'application/json');
        Long plusOneDate = DateTime.now().addDays(1).getTime() / 1000;
        Long nowTime = DateTime.now().getTime() / 1000;
        JSONGenerator gen = JSON.createGenerator(true);
        gen.writeStartObject();
        gen.writeStringField('ssoProvider', 'xxxx');
        gen.writeFieldName('claims');
        gen.writeStartObject();
        gen.writeStringField('email', UserInfo.getUserEmail());
        gen.writeEndObject();
        gen.writeEndObject();
        request.setBody(gen.getAsString());
        HttpResponse response = http.send(request);
        return (String)response.getBody();
  
    }catch (exception e){
        throw new AuraHandledException(e.getMessage());
    }
}

Answer 1

You need to move the business logic to server side.

Consider using PageReference object or other means to open hostUrlLogin to pass encryptedClaims on server side and avoiding passing that to client

Submit of a form is usually performing a POST HTTP Request. Which can be done in Apex server side code like following.

Still, it is not clear if that form accepts JSON body submission or any other submission types, and that can be corrected if needed. Assuming the form accepts JSON body, we could potentially use the following code

    HttpRequest request = new HttpRequest();
    request.setTimeout(120000);
    request.setEndpoint('xxxxxx');
    request.setMethod('POST');
    //request.setHeader('x-api-key', 'xxxxxx');
    request.setHeader('content-type', 'application/json');
    request.setBody(JSON.serialize(new Map<String, Object>{
        'targetUrl' => targetUrl,
        'ssoProvider' => ssoProvider,
        'encryptedClaims' => encryptedClaim
    }));
    HttpResponse res = new Http().send(request);
    

Answer 2

I agree with the other answer (& comment) as a fix but I'am not able to find public documentation from Salesforce side.

We faced similar undocumented vulnerabilities from Salesforce side and they gave us a free submission the next time.

If your package is paid, I would highly recommend raising a support case and asking for public doc else pushing for a free submission the next time.

There has been a rise in undocumented security vulnerabilities from Salesforce side after the recent(March'23) changes in fee structure for package submissions.