The following Javascript is embedded into a Visualforce page because it relies on Visualforce variables:
<apex:page controller="myController" >
<script>
var foo1 = '{!URLFOR($Asset.SLDS)}';
var foo2 = '{!JSENCODE(bar)}';
bar(foo1, foo2);
</script>
...
</apex:page>
After having passed Salesforce Security Review for years this code now failed because:
JS not in Static Resource Vulnerability: All non-Salesforce Javascript files must be included in your offering as part of a static resource. Javascript files may not be loaded from third-party CDN's. (documented here https://partners.salesforce.com/0693A000007QbpbQAC)
Can I mark this as False-Positive or can I make Visualforce variables work using apex:includeScript
and a Static Resource.