1

I am in the process of preparing materials for our security review submission. I have a case where our Apex code calls out to our backend API:

  • Directly from Apex code
  • Background job: Schedule, trigger or apex job

Could you please provide guidance on how to use the ZAP Scanner to scan/test this flow? For instance, in Screen A of the package, we make a callout to the backend API. Should I:

  1. Open ZAP
  2. Log in to our Salesforce
  3. Navigate to this screen
  4. Simulator the scenario, where the backend API callout occurs
  5. ZAP scan

Is this the correct way to proceed? Considering that Salesforce encompasses not only our package but also many other stuffs/components, how can we ensure that the alerts are specific to our package and not related to other components?

For example, in my specific scenario, the ZAP report flagged an SQL Injection error

https://staging-manabie.lightning.force.com/aura?r=43-2&aura.DynamicComponent.getTemplateDescriptorWithExpansionBundle=1

enter image description here enter image description here However, this request was not part of our code; it was triggered by Salesforce somewhere. Do we need to fix it or document it as a false positive? Honestly, I'm not sure what the request does, so I don't know how to explain it.

Improve this question
7
  • Either use Chimera or use Zap with a simulation against your end point, perhaps using Postman.
    – Phil W
    Commented May 26 at 7:11
  • 1
    Does this answer your question? How to OWASP ZAP scan external REST API using OAuth2
    – Phil W
    Commented May 26 at 7:12
  • @PhilW It is not API-only. Should we replace the entire flow (without accessing the app on Salesforce) with Postman only? Additionally, do we need to use ZAP Scan for a 100% native Salesforce?
    – vctqs1
    Commented May 26 at 8:45
  • You use Zap to scan any custom REST APIs and UIs with custom components (or VF pages) to see if there are any vulnerabilities in this sort of code. Your external stuff can be scanned directly. The idea is to start with the URLs that Salesforce invokes, with any parameters Salesforce would send.
    – Phil W
    Commented May 26 at 18:44
  • @PhilW ohm thank you got it
    – vctqs1
    Commented May 27 at 11:40

0

Reset to default

You must log in to answer this question.