0

I've created a managed package and I'd like to release on the Salesforce App Exchange. But if failed the security review. Salesforce gave these reasons:

-CRUD/FLS Enforcement

-CSRF

-Insecure Endpoint

-Insecure Storage of Sensitive Data

-JS not in Static Resource

-Sensitive Information in Debug

-Sensitive information in URL

This is one function, with a PageReference redirect:

public PageReference save() {        
try {

        if (currentSearch.Name == '') {
            currentSearch.Name = 'noname';
        }
        if (currentSearch.Name == null) {
            currentSearch.Name = 'noname';
        }

        if (Schema.sObjectType.PrivateIncInfo__Search__c.isCreateable()) {
            insert currentSearch;
        } else {
            SameDayUserMessageModel.addUserMessage('Error! We were not allowed to create a Search object (track of the details of what you are searching for). Please talk to the Salesforce admin or manager at your organization, and ask for the appropriate permissions.', 'error');
        }

} catch(System.DMLException e) {
        String message = 'Error: we tried to save your search results, but Salesforce rejected your results: ' + e;
        SameDayUserMessageModel.addUserMessage(message, 'error');
}

// After successful Save, navigate to the page that shows SearchResult__c 
// objects that are children of this PrivateIncInfo__Search__c. 
PageReference redirectSuccess = new PageReference('/apex/SameDaySearchResult?id=' + currentSearch.Id);
return (redirectSuccess);
}

So, are they complaining about this line?

PageReference redirectSuccess = new PageReference('/apex/SameDaySearchResult?id=' + currentSearch.Id);

Am I not allowed to have variables in the url I use with PageReference?

0

I will answer the question a bit differently. It doesn't matter why they didn't like this line

PageReference redirectSuccess = new PageReference('/apex/SameDaySearchResult?id=' + currentSearch.Id);

As it will not work in a package once it's been installed

Your path will have changed to /apex/<Namespace>__SameDaySearchResult, and that is not what you hardcoded there.

I suggest you change your code the following way

PageReference redirectSuccess = Page.SameDaySearchResult;
redirectSuccess.getParameters().put('id',currentSearch.Id);

That way you're being both namespace safe and you're not hardcoding URLs in the code (which I think is why you got dinged)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.