Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
2
votes
0answers
26 views

Information Disclosure Vulnerability

Here is a security vulnerability issue of "Information Disclosure" reported by the Salesforce Team. URL https://yourdomain.lightning.force.com/aura?r=13&aura.DynamicComponent....
1
vote
1answer
17 views

Is there any way to set feature parameters for beta versions which did not pass security review?

Is there any way set feature parameters for package beta versions which did not pass security review? Assuming you are going to release a new version of package which will include feature parameters. ...
4
votes
0answers
50 views

AppExchange Apps - Security Concerns on embedding URLs with Encrypted Short Lived Access Tokens

We are working on an AppExchange App which integrates with external application at the UI Layer. External application (composite app) has different widgets which we can embed within AppExchange Aura ...
0
votes
1answer
24 views

Will the use of apex:actionFunction result in a CSRF vulnerability?

I need the record to be updated when the visualforce page loads. In the apex:page tag, I utilised the action property to invoke the apex method that executes update DML. Salesforce considers an onload ...
1
vote
1answer
23 views

How can I change custom settings field visibility which contains sensitive data to private or protected?

In the process of getting a managed package reviewed and it has been flagged for Insecure Storage of Sensitive Data and highlight the following xml. <?xml version="1.0" encoding="UTF-...
3
votes
1answer
99 views

Security Review: Lightning: CSS Outside Component

In our SF Security Re-Review report a lightning component was flagged for "Lightning: CSS Outside Component". The lines they referenced were: ... <button style="font-size: 20px;top: ...
1
vote
1answer
213 views

GET Request with Client ID and Client Secret as Parameter

We are working on an AppExchange app which integrates with 3rd Party application. To connect external app with Salesforce, a Subscriber System admin needs to connect External System using Client Id/...
1
vote
1answer
52 views

Checkmarx - Bulkify Apex Methods Using Collections In Methods

Recently I ran a checkmarx scan and saw this issue Query: Bulkify Apex Methods Using Collections In Methods I don't understand why checkmarx is showing this issue in few places and not in all methods....
3
votes
0answers
67 views

Publishing platform event in doInit of Aura or page load action cause any security vulnerability? [closed]

We have a scenario to publish platform event in doInit of Aura Component (or) action of visualforce page, where in the platform event trigger we're making a dml. As far as we researched and debugged, ...
1
vote
0answers
58 views

FLS and CRUD Check for Platform event and Meta Data DML

This might be a silly question, but don't want to get caught under security review. I have three questions/confirmations related to the security review FLS/CRUD Check Needed while publishing platform ...
3
votes
1answer
91 views

Using Window.SessionStorage in product development cause any security vulnerability?

We're storing some encrypted text in the session Window.sessionStorage for community portal, just to avoid multiple server call backs for different navigations. Will it be flagged under any security ...
2
votes
2answers
109 views

SessionID access vulnerability found when using Metadata API

Salesforce is performing manual security review in our package. They have found SessionID access Vulnerability in one of our file where we are using Metadata API to grant permissions on profile and ...
0
votes
1answer
91 views

Passing Client Id and Client Secret in URL as Encrypted String for AppExchange App

We are developing an AppExchange application which integrates with external application .Every customer has a connected app because of different branding and different and different callback URLs. ...
3
votes
0answers
44 views

lightning:container performance/security and why no alternative in LWC [closed]

Is there any specific reason as to why salesforce has not provided the equivalent of lightning:container in LWC ? Since lightning:container places the component in an iFrame, is it good to use it (in ...
0
votes
2answers
95 views

URL Redirection Attack - Source Scanner Results

I have got Query: URL Redirection Attack during Source Scanner. Piece of controller @AuraEnabled public static String forgotPassword(String username, String checkEmailUrl) { try { Site....
1
vote
2answers
52 views

Security review for a managed package with Polymorphic SOQL queries

I checked the documentation "Enable Field- and Object-Level Permissions Checking Using WITH SECURITY_ENFORCED in SOQL Queries". But looks like the below query won't work because traversing a ...
1
vote
1answer
69 views

Aura:html tags in component flagged in Security Review

We have received Security review issues for <aura:html tag="style"> used in Lightning component .cmp file. This was done to change the modal width which is opened from Quick Action. &...
0
votes
0answers
27 views

Not able to reproduce checkmarx scann results using SFDX scanner

We got these below eeors when we submitter our code for security review in salesforce portal In order to fix the issue we are trying to replicate the issues using SFDX scanner in our local but SFDX ...
0
votes
1answer
33 views

CxSAST URL for VSCode

We are trying to host our application in Appexchange. So before submitting we did scan code review in security portal of salesforce and got some errors. We are trying to fix those issues in our local ...
0
votes
0answers
11 views

Code Scanner Portal show error in browser console

I try do security scanner for our code. I use this "Force.com Code Scanner Portal" website to do it. This is the website link: https://security.secure.force.com/security/tools/forcecom/...
0
votes
1answer
95 views

SessionId in LWC for Security Review

I am using this workaround to get the SessionId in my LWC and perform a callout from the JS. I am concerned about if it will pass the security review for managed packages. Have someone used it and can ...
0
votes
0answers
86 views

Issue with Chimera Scans - Chimera abuse prevention token

Chimera scan is not working properly. The token file is located correctly, I checked the file location using the site url and I can access the token file. But the scan is still complaining with the ...
11
votes
0answers
114 views

Is there a reliable way to have WITH SECURITY_ENFORCED applied to all queries?

I've just gone through a biggish code base making sure that WITH SECURITY_ENFORCED is set on every query. Most were, but for some recent additions, it hadn't been included. For managed packages that ...
1
vote
1answer
43 views

Query: Password APIs Issue on Salesforce Security Report

We have a scenario to allow the user to reset the password for the community users, We have used the following snippet System.resetPassword(userId, true); So its blocked in the security report under ...
0
votes
0answers
236 views

Content Security Policy: Wildcard Directive

For a security review, I ran ZAP scanner on my application (Salesforce URL) and it is reflecting some security issues. The description for CSP issue is as follows: The following directives either ...
0
votes
1answer
40 views

Update Lightning API Version

I need to update lightning API version to 40 or more for Open CTI components as it is the requirement of security review. Currently, I have version 38.0. I wanted to know how can I update API version. ...
1
vote
0answers
43 views

Callable : Can we call class methods from different managed package without using namespace?

CALLABLE Enables developers to use a common interface to build loosely coupled integrations between Apex classes or triggers, even for code in separate packages. I have created an LWC component and ...
0
votes
0answers
58 views

getting Client DOM Code Injection security issue in lightning controller

In scanning, I got Client DOM Code Injection security issue in lightning controller for below section: window.addEventListener("message", function(event) { var message = event.data; }, false)...
1
vote
1answer
49 views

Force.com Source Scanner Results: FLS Update and Create

I've run the Force.com Source Scanner against my Managed Package and here are the summary results: There are two areas FLS Update and FLS Create where I got 28, and 37 risks respectively... I am ...
0
votes
1answer
220 views

SECURITY ENFORCED exception in Rest Callback

I've added the WITH SECURITY_ENFORCED clause to my SOQL query. The query is present at a Rest service for a callback so I am testing it by creating a public site will create a profile (External Users ...
0
votes
2answers
77 views

Can I perform DML operation via apex (system context) on object where logged in profile user never have access?

Will it be a problem to perform DML on an object where the user never have access? Will it lead to salesforce audit violation kind of thing if I implement this? Use Case: Trying to perform DML ...
1
vote
1answer
25 views

not checking for Id in FLS checks before query and DML [duplicate]

I am not checking for Id in FLS checks before query and DML. Is this a security review vulnerability in salesforce?
0
votes
1answer
27 views

What are Aura: Aysnc Code and Sharing Violation vulnerabilities from the security review of the application(AppExchange)

I was creating an application to publish in app exchange and so I had submitted the application for security review but the report cointained:- We have completed the security review of your ...
1
vote
0answers
94 views

Getting "Lightning: CSS Outside Component" vulnerability in security review

As in salesforce security review report, it's mentioned that we should not use float or position: absolute or fixed. Uses non-standard positioning (via float or position: absolute or fixed) breaks ...
2
votes
1answer
24 views

Recommended explicit sharing declaration for inner classes

In our last Salesforce Security Review we have faced an issue related to the ommitted sharing declarations of inner classes acting as a wrapper. We have passed this review for years so I guess some ...
4
votes
1answer
139 views

Make Visualforce variable in Javascript pass Security Review

The following Javascript is embedded into a Visualforce page because it relies on Visualforce variables: <apex:page controller="myController" > <script> var foo1 =...
6
votes
1answer
191 views

Package review fails with new undocumented issues

My Managed package (yearly) Security Review failed with new issues I was not aware of and which I could not find documented anywhere, E.g.: Stored XSS - "Avoid using escape=false unless ...
0
votes
0answers
89 views

Where can we get appexchange before payment coupon codes?

I am about to submit my app for security review, in payment page i could see coupon code available. I would like to get one. so where can I get one coupon code ? Also from the security review video ...
4
votes
2answers
172 views

Security Review - False Positive for SOQL Injection - Configuration Data (Input only by System Admin User)

I am using a dynamic query in one of our AppExchange products. There is an LWC component within our app, which has a property called filterLogic as below: <targetConfig targets="...
3
votes
2answers
167 views

Filtering JavaScript out of HTML

A recent Salesforce Security review flagged the case of inserting this directly into a database text field: <h1>Hello</h1> <img src=x onerror=alert(document.cookie)> <h1>World&...
1
vote
1answer
125 views

Checkmarx Security Scanner FLS Issues

I run the checkmarx scanner for app and received ~250 FLS issues, which is understood, because when the app developed it simply was not checked. However I have noticed that there are lots of cases ...
1
vote
0answers
38 views

Will deprecated classes raise any security issues?

I submitted my managed package for a security review few days ago. After submitting, I found out that I don't have to use an Apex class in the package. So, I tried to delete that class but couldn't ...
2
votes
2answers
81 views

Consolidate Multiple Manage Packages With Dependency?

I am currently building a app to publish in market, done with with my development based on 2gp model, but I am confused on final package creation that Should i need to create single manage package ...
1
vote
1answer
54 views

Managed Package - Protected Custom Setting for storing creds - Security review

I have created a managed package where I used a protected Custom Setting of hierarchy type to store some user credentials. I am concerned about security review of the app. Is there any chances of ...
1
vote
1answer
274 views

Lightning - Security review problems

We are using the following css in one of our component. In security review it throws an error as follows. 1)Lightning: CSS Outside Component Code: .THIS.wrapper-app > lightning-spinner { ...
1
vote
1answer
96 views

Managed Package, Security Review and LWC DOM Manipulation

I started developing a managed package and I need to manipulate the DOM in a Lightning Web Component, In the component HTML, I added lwc:dom="manual" to the target element and everything ...
0
votes
0answers
169 views

Getting checkmarx FLS_Create Error in apex

Checkmarx is giving me the FLS_Create error in the below code. cv.PathOnClient = docName; cv.VersionData = requestbody; cv.ContentLocation = 'S'; cv....
5
votes
2answers
3k views

How to OWASP ZAP scan external REST API using OAuth2

I have built a Managed Package that talks to an external REST API using OAuth2 Named Credentials. I now want to submit this app for Security Review. I can't use the Chimera Scanner as it would require ...
1
vote
1answer
147 views

How to remove Salesforce CRUD Delete Security Risk?

When I scanned my app yesterday, and it raised a bunch of CRUD Delete security issue. So, I added isDeletable() check to all the delete query, and scanned it again. Still, it showed the same security ...
4
votes
1answer
195 views

Will an app where all the Apex is "without sharing" pass a Salesforce Security Review?

We are working on a portal app that will run inside a Community and the limited sharing rule capabilities of the lowest priced Communities licenses is making life difficult, particularly as this app ...

1
2 3 4 5 6