Make Visualforce variable in Javascript pass Security Review

Question

The following Javascript is embedded into a Visualforce page because it relies on Visualforce variables:

<apex:page controller="myController" >
    <script>
            var foo1 = '{!URLFOR($Asset.SLDS)}';
            var foo2 = '{!JSENCODE(bar)}';

            bar(foo1, foo2);
    </script>
    ...
</apex:page>

After having passed Salesforce Security Review for years this code now failed because:

JS not in Static Resource Vulnerability: All non-Salesforce Javascript files must be included in your offering as part of a static resource. Javascript files may not be loaded from third-party CDN's. (documented here https://partners.salesforce.com/0693A000007QbpbQAC)

Can I mark this as False-Positive or can I make Visualforce variables work using apex:includeScript and a Static Resource.

Answer 1

This is clearly a false positive as you are not using any JavaScript from the CDN. Since the JavaScript is within the Visualforce Page it should be ok.

Disclaimer : Please consult with the Salesforce Security review team regarding this and do not treat my answer as official from Salesforce.

Now there are few more things you can do to avoid having JavaScript code on the Visualforce page.

<script>
        window.foo1 = '{!URLFOR($Asset.SLDS)}';
        window.foo2 = '{!JSENCODE(bar)}';
</script>

Then in your Static resource, you can do below

(function (window) {     
     function bar(foo1, foo2) {
        //
     }
     bar(foo1, foo2);
})(window);