Am I allowed to have a variable url in a PageReference redirect in a managed package released on the App Exchange?

Question

I've created a managed package and I'd like to release on the Salesforce App Exchange. But if failed the security review. Salesforce gave these reasons:

-CRUD/FLS Enforcement

-CSRF

-Insecure Endpoint

-Insecure Storage of Sensitive Data

-JS not in Static Resource

-Sensitive Information in Debug

-Sensitive information in URL

This is one function, with a PageReference redirect:

public PageReference save() {        
try {

        if (currentSearch.Name == '') {
            currentSearch.Name = 'noname';
        }
        if (currentSearch.Name == null) {
            currentSearch.Name = 'noname';
        }

        if (Schema.sObjectType.PrivateIncInfo__Search__c.isCreateable()) {
            insert currentSearch;
        } else {
            SameDayUserMessageModel.addUserMessage('Error! We were not allowed to create a Search object (track of the details of what you are searching for). Please talk to the Salesforce admin or manager at your organization, and ask for the appropriate permissions.', 'error');
        }

} catch(System.DMLException e) {
        String message = 'Error: we tried to save your search results, but Salesforce rejected your results: ' + e;
        SameDayUserMessageModel.addUserMessage(message, 'error');
}

// After successful Save, navigate to the page that shows SearchResult__c 
// objects that are children of this PrivateIncInfo__Search__c. 
PageReference redirectSuccess = new PageReference('/apex/SameDaySearchResult?id=' + currentSearch.Id);
return (redirectSuccess);
}

So, are they complaining about this line?

PageReference redirectSuccess = new PageReference('/apex/SameDaySearchResult?id=' + currentSearch.Id);

Am I not allowed to have variables in the url I use with PageReference?

Answer 1

I will answer the question a bit differently. It doesn't matter why they didn't like this line

PageReference redirectSuccess = new PageReference('/apex/SameDaySearchResult?id=' + currentSearch.Id);

As it will not work in a package once it's been installed

Your path will have changed to /apex/<Namespace>__SameDaySearchResult, and that is not what you hardcoded there.

I suggest you change your code the following way

PageReference redirectSuccess = Page.SameDaySearchResult;
redirectSuccess.getParameters().put('id',currentSearch.Id);

That way you're being both namespace safe and you're not hardcoding URLs in the code (which I think is why you got dinged)