Currently, we are trying to publish an App on AppExchange and in the technical review, JS vulnerability issue was highlighted for most of the JS buttons that we created in the app.Below was the error we got:

JavaScript of any type is not allowed to run within the Salesforce.com application context. This includes JavaScript blocks within HomePageComponents, WebLinks, and all other components that are run under the Salesforce.com DOM.

In most of the list view buttons, we used {!GetRECORDIDS} to get id of selected records and performed some operation on them but due to JS vulnerability issue, we dropped them off(all the list view buttons from the package) as of now.

My concern is regarding the custom JS buttons on the record detail page.We are using {!customobject__c.id} to get id of the current record and then performing some logic in that button on basis of that id we get from URL

Just want to know if the above scenario would also fall under JS vulnerability issue and if yes, just encoding that ID in that JS button would solve that and the review won't point them as vulnerability again, right?

Anyone who has actually published an app before and faced such issue, please help


This was allowed before but I am sure now anything Javascript on list button or the detail page button is not allowed because when your app finally gets changed to lightning these will be un supported .

You can easily convert all these buttons to visualforce type .For List buttons use standard Set controller and for Detail Page button use Standard controller .

With Standard Controller you will easily get the recordId as needed .

  • @ mohith- thank you for sharing the information.This really helped. – Abhijeet Aug 8 '16 at 12:08
  • just want to confirm on one thing- suppose i convert these JS buttons to VF pages and for some validation, i still need to use some Javascript in my VF page.So, using Javascript in my VF page is allowed, right? – Abhijeet Aug 8 '16 at 12:16
  • Suppose in my Javascript button(Custom), I am creating a record or may be doing some operations and redirecting to to another URL or may be the newly created record.Will this be counted as a vulnerability? – Abhijeet Aug 10 '16 at 11:03
  • Yes it does .You may want to do it via a cus – Mohith Shrivastava Aug 10 '16 at 11:07
  • Yes it does count. You should use a vf button instead – Mohith Shrivastava Aug 10 '16 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.