3

We have developed a Drag & Drop multiple Image Upload with Html5, jQuery and the REST API.
We are wondering what are the problems that this feature can bring up in the security review.

Let me explain how do we managed to implement this:

  • With html5, enabled a div to allow the multiple drop of files
  • Via javascript & jQuery, validate if the files dropped are images (gif, png, jpeg, jpg) and have less than 2MB
  • If so, with jQuery ajax upload them, one by one, to a apex REST class. The image is received by the REST within a Blob, so we get the response.body and then put it in a document body, insert the document and return Ok to ajax.

This was implemented in a backoffice visual force page, to allow the users to upload photos for a custom objects.
Before this, we used to have a visualforce page with the apex component inputFile, and we'll keep using it, of course, for browsers versions that don't support html5.

  • You have probably run into this app - it passed security review, so it should be straightforward. Are you already running into particular issues? Did you scan it? – ReidCarlberg Mar 7 '13 at 11:37
  • Thanks for the feedback. Yes, i've already scanned it with no problems. Is it possible to view the source code of that app? – Ivo Rocha Mar 7 '13 at 11:57
  • I don't know how they've set it up, so I can't answer about the source. – ReidCarlberg Mar 7 '13 at 14:27
3

We've run similar upload forms through security review and haven't had any problems. The security scanner is the basis for most of their concerns. As long as your working on the same domain browsers enforce pretty strict access policies that keep salesforce users safe from cross-domain access exploits.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.