0

We have created a Second Generation Managed Package and in it we need to load the static resource which is uploaded by the Subscriber (the one who installs the package).

We have loaded the static resource using the URL approach (/resource[/timestamp]/YourStaticResourceName) mentioned in this link

And In one LWC Component, we have a requirement of Custom Datatype of Lightning Datatable. So we have used a Custom Component for Custom Datatype and for passing data from Custom Component to our Lightning Datatable Component we have used Custom Event with bubbles and composable parameters set as true and In the Datatable Event Handler, we have stopped the event propagation, so that the custom event doesn't pass or propagate behind the Datatable Component and stays in the Managed Package Boundary.

Will these approaches pass the Salesforce AppExchange Security Review?

Improve this question

2 Answers 2

Reset to default
1

We allow customization in our package using similar static resource upload, and naming via a setting. We don't manually generate the URL, using URLFOR instead. But, regardless, this should not cause any issues with security review.

As to the LWC event propagation, AFAIK what you have done will not cause any security review issues (fairly sure we have a couple of places we do similar). If you are concerned, the best approach is to explicitly cover this event usage pattern in your false positive documentation provided as part of your submission.

Improve this answer
4
  • Thanks for the reply Phil, We have used Custom Event with bubbles and composable parameters set as true, does this impact security review in anyway. I have edited the question. Please check it.
    – S1th
    Commented Oct 27, 2023 at 14:10
  • It would have been best to cover that in a separate question, TBH, but I've updated my answer anyway.
    – Phil W
    Commented Oct 27, 2023 at 16:48
  • Thanks for your reply, Phil.
    – S1th
    Commented Oct 28, 2023 at 7:01
  • Hi @Phil W, We want to make our Managed Package licensed, So we have few doubts regarding the licenses and permission sets. I have asked a question. Could you please us. salesforce.stackexchange.com/questions/412796/…
    – S1th
    Commented Nov 5, 2023 at 13:08
0

You should not have any issues with this pattern. If it's flagged, file a case in partner portal as this is fine.

Improve this answer
3
  • Thanks for the reply Robert, We have used Custom Event with bubbles and composable parameters set as true, does this impact security review in anyway. I have edited the question. Please check it.
    – S1th
    Commented Oct 27, 2023 at 14:13
  • Yeah, you can bubble/compose events, just load the resource in your namespace as you are doing.
    – Robert Sussland
    Commented Oct 27, 2023 at 22:16
  • Thanks Robert, we are loading the resource in our manage package codes only i.e in our Namespace only.
    – S1th
    Commented Oct 28, 2023 at 7:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .