I'm trying to create a developer tool for the AppExchange that is able to create unmanaged Apex classes dynamically (for example, after clicking a button in the app.)

  • Does salesforce allow ISV apps to create unmanaged code in a sandbox environment?
  • Are there restrictions that would prevent an app like this from passing a security review?
  • Are there different restrictions based on if the metadata is created from within Apex in a managed package vs. an external web service?
  • As Mohith mentioned, I would very strongly encourage you to make use of office hours. This is something the security review team is very sensitive to and they may have requests about how to implement this. Talking to them before building too far would be wise. security.secure.force.com/security/contact/ohours – ca_peterson Jul 25 '16 at 5:29

There is no restriction provided you follow best practices .

Creating of apex class on the fly means you will be using

1.Javascript to call the apex metadata API

2.Metadata API apex wrapper

3.An external canvas app running on heroku which will call sfdc metadata API

Salesforce ISV will allow provided you have business reason to do this and your script and callout follow Security best practices like creating remote site settings and connected apps

I cannot confirm but as far as I have seen there is no restrictions but schedule an office hour with security team to seek guidance and figure out if they have any issues with your approach and your use case

There is no restriction from apex vs webservice .Any API call via apex should have end point whitelisted in Remote Site Settings .


Apart from the answer above I would like to add one more point.

If I would have to do something like this then I would perform this action from 3rd party application. This way it will be out of security scanner. also you will be able to build and deploy metadata using API.

  • @ArulRajguru If you take it outside platform then you will have to BURP scan the external endpoint . – Mohith Shrivastava Jul 24 '16 at 11:28
  • Right.but apart from burp scan you are free to take control of metadata,deploy unmanaged code. Agree? – AtulRajguru9 Jul 24 '16 at 17:43
  • Agree :) .The flexibility that you will get will be huge – Mohith Shrivastava Jul 24 '16 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.