1

I have just been sent back the security review report for our ISV partner app and one of the errors is 'JS in Salesforce DOM'. The file they have referenced is a .weblink file, the code snippet they've included is xml.

The issue I'm having is that I cannot find any .weblink file or any of the xml from the snippet anywhere in my code base. This is a project I've taken over managing from somebody else so it's not something I've created. I've tried retrieving from source to pull in any missing files but I still can't find any trace of the file causing the issue.

Is there a way to get to this file through the connected Salesforce dev org and remove the relevant parts?

NOTE: It's a first generation managed package

Code snippet sent back is included below (some info has been changed to generic names):

<?xml version="1.0" encoding="UTF-8"?>
<CustomPageWebLink xmlns="http://soap.sforce.com/2006/04/metadata">
    <availability>online</availability>
    <displayType>link</displayType>
    <linkType>javascript</linkType>
    <masterLabel>MASTER LABEL NAME</masterLabel>
    <openType>onClickJavaScript</openType>
    <protected>false</protected>
    <url>{!REQUIRESCRIPT(&quot;/resource/1332259367000/abc__JQuery&quot;)}
{!REQUIRESCRIPT(&quot;/resource/1332260562000/abc__AScript&quot;)}
{!REQUIRESCRIPT(&quot;/resource/1332322105000/abc__BScript&quot;)}
{!REQUIRESCRIPT(&quot;/resource/1332333167000/abc__CScript&quot;)}
{!REQUIRESCRIPT(&quot;/apex/abc__DScript?core.apexpages.devmode.url=1&quot;)}</url>
</CustomPageWebLink>

The resouces it's referencing are static resources within the project but all the files are empty and no longer required.

1 Answer 1

2

CustomPageWebLink is present on the Home Page component in the classic Salesforce experience.

Look if your org has this link or your package source has this. I would either delete from the org or if cannot be deleted simply make it empty and get rid of the reference to any script.

Since it is 1GP package, I have a feeling Security review just found this in your packaging org. So double check your org.

2
  • Thank you, where in my org would I go to delete it? I've tried searching through setup but I've not been able to find any references to it.
    – lhh13
    Jul 27, 2023 at 15:49
  • 1
    Found it, might not have been the quickest way but deleted it by switching to classic, then going to Setup > Customize > Home > Custom Links then clicking delete on the link causing the issue.
    – lhh13
    Jul 27, 2023 at 16:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .