Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
0 votes
1 answer
15 views

SOAP Web API scan for underlying API undder my salesforce app

we are using the web API (SOAP) as a backend in our salesforce app. Do I need to attach the ZAP/Burp or Chimera report with my submit material ? or these reports are only required for WebAppliaction . ...
user avatar
0 votes
1 answer
18 views

security review payment needed every time a different package is submitted?

does every time I submit a package for review the review fee has to be paid? Or is it just once per year?
user avatar
  • 194
2 votes
0 answers
16 views

How to avoid using position:absolute in stylesheets for aura components due to security concerns as mentioned in the ISV guide

I'm trying to pass security review for my managed package. I have to a security issue to address: Unsafe CSS position declaration: position: absolute; The Salesforce Platform tries to ensure that ...
user avatar
2 votes
0 answers
30 views

Possibility to Install a managed package on production while package is under Security Review

We are working on a managed package, which we are planning to submit for security review in a few weeks. While the package will be in the security review, we would also like to install the managed ...
user avatar
  • 2,212
0 votes
1 answer
26 views

VfUnescapeEl PMD fix for salesforce static resource page

We are getting VfUnescapeEl error in our sfdx report on the following line : <a href="{!LEFT($CurrentPage.URL,FIND('/',$CurrentPage.URL,9))}{{x.Id}}">...</a> here, x.id will be ...
user avatar
  • 1
0 votes
1 answer
44 views

Necessity to resolve all PMD issues for security review

We generated a pmd report using sfdx, is it necessary to resolve all the sfdx report issues to pass the salesforce security review or those are just warnings and can be ignored to pass the security ...
user avatar
0 votes
1 answer
23 views

Does Upgrading Major Version Number Trigger Security Review

We're rolling out a larger change in our manage package and it would be nice to recognise these changes by increasing the Major version number on our package. The concern is whether it will trigger a ...
user avatar
0 votes
1 answer
45 views

Why newly released package version is not available in Partner Security Portal scanner?

We have released a new minor 2GMP release version and try to check it for Security and Quality rules in Partner Security Portal scanner, but the new version doesn't show up in the picklist for Select ...
user avatar
  • 13.2k
1 vote
1 answer
40 views

Pass SF security review and keep <apex:pageMessages escape="false"/> in a visualforce page

to pass security review we must avoid <apex:pageMessages escape="false"/> But without the escape="false", my message will not be clickable anymore. So inside my controller, I ...
user avatar
  • 11
0 votes
0 answers
45 views

How to Scan External callouts( APIs ) in OWASAP ZAP

In my environment, I have used a couple of external APIs I need to scan in OWASAP ZAP OWSAP ZAP for security review. it is possible another way to Scan Callouts Api and generate reports? I have ho ...
user avatar
2 votes
1 answer
51 views

Risks & Benefits of Installing Someone Else's Unlocked 2nd Gen Package

I'm interested in introducing a GitHub project into our enterprise org. That GitHub project currently offers the tool in both Managed Package and Unlocked Package format. The Unlocked Package format ...
user avatar
0 votes
1 answer
41 views

Is it a liability to use the lightning container npm package? (not been updated for 4 years...)

I have embedded my react app in a lightning container iframe as the docs suggest. <aura:component access="global" implements="flexipage:availableForAllPageTypes"> <...
user avatar
  • 1
1 vote
1 answer
354 views

URL Redirect Attack - Apex

I have been trying to fix the below URL Redirection Attack code block but couldn't find a working solution: String url = '/' + oGenericObj.getDescribe().getKeyPrefix() + '/e'; ...
user avatar
-3 votes
1 answer
110 views

Security Scanner Report in Owasp zap

How to scan my salesforce app in Owasap zap, need to cover everything such as custom objects, flow, process builder, reports and dashboard, etc. at the end need to generate a report, is possible?
user avatar
2 votes
0 answers
91 views

Information Disclosure Vulnerability

Here is a security vulnerability issue of "Information Disclosure" reported by the Salesforce Team. URL https://yourdomain.lightning.force.com/aura?r=13&aura.DynamicComponent....
user avatar
  • 397
1 vote
1 answer
61 views

Is there any way to set feature parameters for beta versions which did not pass security review?

Is there any way set feature parameters for package beta versions which did not pass security review? Assuming you are going to release a new version of package which will include feature parameters. ...
user avatar
  • 13.2k
4 votes
0 answers
54 views

AppExchange Apps - Security Concerns on embedding URLs with Encrypted Short Lived Access Tokens

We are working on an AppExchange App which integrates with external application at the UI Layer. External application (composite app) has different widgets which we can embed within AppExchange Aura ...
user avatar
  • 2,212
0 votes
1 answer
41 views

Will the use of apex:actionFunction result in a CSRF vulnerability?

I need the record to be updated when the visualforce page loads. In the apex:page tag, I utilised the action property to invoke the apex method that executes update DML. Salesforce considers an onload ...
user avatar
  • 1
1 vote
1 answer
60 views

How can I change custom settings field visibility which contains sensitive data to private or protected?

In the process of getting a managed package reviewed and it has been flagged for Insecure Storage of Sensitive Data and highlight the following xml. <?xml version="1.0" encoding="UTF-...
user avatar
3 votes
1 answer
142 views

Security Review: Lightning: CSS Outside Component

In our SF Security Re-Review report a lightning component was flagged for "Lightning: CSS Outside Component". The lines they referenced were: ... <button style="font-size: 20px;top: ...
user avatar
  • 1,377
1 vote
1 answer
802 views

GET Request with Client ID and Client Secret as Parameter

We are working on an AppExchange app which integrates with 3rd Party application. To connect external app with Salesforce, a Subscriber System admin needs to connect External System using Client Id/...
user avatar
  • 2,219
1 vote
1 answer
92 views

Checkmarx - Bulkify Apex Methods Using Collections In Methods

Recently I ran a checkmarx scan and saw this issue Query: Bulkify Apex Methods Using Collections In Methods I don't understand why checkmarx is showing this issue in few places and not in all methods....
user avatar
  • 193
3 votes
0 answers
77 views

Publishing platform event in doInit of Aura or page load action cause any security vulnerability? [closed]

We have a scenario to publish platform event in doInit of Aura Component (or) action of visualforce page, where in the platform event trigger we're making a dml. As far as we researched and debugged, ...
user avatar
1 vote
0 answers
117 views

FLS and CRUD Check for Platform event and Meta Data DML

This might be a silly question, but don't want to get caught under security review. I have three questions/confirmations related to the security review FLS/CRUD Check Needed while publishing platform ...
user avatar
3 votes
1 answer
131 views

Using Window.SessionStorage in product development cause any security vulnerability?

We're storing some encrypted text in the session Window.sessionStorage for community portal, just to avoid multiple server call backs for different navigations. Will it be flagged under any security ...
user avatar
2 votes
2 answers
241 views

SessionID access vulnerability found when using Metadata API

Salesforce is performing manual security review in our package. They have found SessionID access Vulnerability in one of our file where we are using Metadata API to grant permissions on profile and ...
user avatar
  • 5,714
0 votes
1 answer
214 views

Passing Client Id and Client Secret in URL as Encrypted String for AppExchange App

We are developing an AppExchange application which integrates with external application .Every customer has a connected app because of different branding and different and different callback URLs. ...
user avatar
3 votes
0 answers
84 views

lightning:container performance/security and why no alternative in LWC [closed]

Is there any specific reason as to why salesforce has not provided the equivalent of lightning:container in LWC ? Since lightning:container places the component in an iFrame, is it good to use it (in ...
user avatar
0 votes
2 answers
194 views

URL Redirection Attack - Source Scanner Results

I have got Query: URL Redirection Attack during Source Scanner. Piece of controller @AuraEnabled public static String forgotPassword(String username, String checkEmailUrl) { try { Site....
user avatar
  • 11
1 vote
2 answers
151 views

Security review for a managed package with Polymorphic SOQL queries

I checked the documentation "Enable Field- and Object-Level Permissions Checking Using WITH SECURITY_ENFORCED in SOQL Queries". But looks like the below query won't work because traversing a ...
user avatar
  • 1,232
1 vote
1 answer
145 views

Aura:html tags in component flagged in Security Review

We have received Security review issues for <aura:html tag="style"> used in Lightning component .cmp file. This was done to change the modal width which is opened from Quick Action. &...
user avatar
0 votes
0 answers
39 views

Not able to reproduce checkmarx scann results using SFDX scanner

We got these below eeors when we submitter our code for security review in salesforce portal In order to fix the issue we are trying to replicate the issues using SFDX scanner in our local but SFDX ...
user avatar
0 votes
1 answer
72 views

CxSAST URL for VSCode

We are trying to host our application in Appexchange. So before submitting we did scan code review in security portal of salesforce and got some errors. We are trying to fix those issues in our local ...
user avatar
0 votes
1 answer
15 views

Code Scanner Portal show error in browser console

I try do security scanner for our code. I use this "Force.com Code Scanner Portal" website to do it. This is the website link: https://security.secure.force.com/security/tools/forcecom/...
user avatar
1 vote
1 answer
223 views

SessionId in LWC for Security Review

I am using this workaround to get the SessionId in my LWC and perform a callout from the JS. I am concerned about if it will pass the security review for managed packages. Have someone used it and can ...
user avatar
11 votes
0 answers
169 views

Is there a reliable way to have WITH SECURITY_ENFORCED applied to all queries?

I've just gone through a biggish code base making sure that WITH SECURITY_ENFORCED is set on every query. Most were, but for some recent additions, it hadn't been included. For managed packages that ...
user avatar
  • 129k
1 vote
1 answer
68 views

Query: Password APIs Issue on Salesforce Security Report

We have a scenario to allow the user to reset the password for the community users, We have used the following snippet System.resetPassword(userId, true); So its blocked in the security report under ...
user avatar
0 votes
1 answer
62 views

Update Lightning API Version

I need to update lightning API version to 40 or more for Open CTI components as it is the requirement of security review. Currently, I have version 38.0. I wanted to know how can I update API version. ...
user avatar
  • 33
2 votes
0 answers
98 views

Callable : Can we call class methods from different managed package without using namespace?

CALLABLE Enables developers to use a common interface to build loosely coupled integrations between Apex classes or triggers, even for code in separate packages. I have created an LWC component and ...
user avatar
0 votes
0 answers
73 views

getting Client DOM Code Injection security issue in lightning controller

In scanning, I got Client DOM Code Injection security issue in lightning controller for below section: window.addEventListener("message", function(event) { var message = event.data; }, false)...
user avatar
1 vote
1 answer
71 views

Force.com Source Scanner Results: FLS Update and Create

I've run the Force.com Source Scanner against my Managed Package and here are the summary results: There are two areas FLS Update and FLS Create where I got 28, and 37 risks respectively... I am ...
user avatar
  • 8,223
0 votes
1 answer
439 views

SECURITY ENFORCED exception in Rest Callback

I've added the WITH SECURITY_ENFORCED clause to my SOQL query. The query is present at a Rest service for a callback so I am testing it by creating a public site will create a profile (External Users ...
user avatar
0 votes
2 answers
130 views

Can I perform DML operation via apex (system context) on object where logged in profile user never have access?

Will it be a problem to perform DML on an object where the user never have access? Will it lead to salesforce audit violation kind of thing if I implement this? Use Case: Trying to perform DML ...
user avatar
1 vote
1 answer
31 views

not checking for Id in FLS checks before query and DML [duplicate]

I am not checking for Id in FLS checks before query and DML. Is this a security review vulnerability in salesforce?
user avatar
0 votes
1 answer
39 views

What are Aura: Aysnc Code and Sharing Violation vulnerabilities from the security review of the application(AppExchange)

I was creating an application to publish in app exchange and so I had submitted the application for security review but the report cointained:- We have completed the security review of your ...
user avatar
1 vote
0 answers
107 views

Getting "Lightning: CSS Outside Component" vulnerability in security review

As in salesforce security review report, it's mentioned that we should not use float or position: absolute or fixed. Uses non-standard positioning (via float or position: absolute or fixed) breaks ...
user avatar
2 votes
1 answer
27 views

Recommended explicit sharing declaration for inner classes

In our last Salesforce Security Review we have faced an issue related to the ommitted sharing declarations of inner classes acting as a wrapper. We have passed this review for years so I guess some ...
user avatar
4 votes
1 answer
184 views

Make Visualforce variable in Javascript pass Security Review

The following Javascript is embedded into a Visualforce page because it relies on Visualforce variables: <apex:page controller="myController" > <script> var foo1 =...
user avatar
6 votes
1 answer
213 views

Package review fails with new undocumented issues

My Managed package (yearly) Security Review failed with new issues I was not aware of and which I could not find documented anywhere, E.g.: Stored XSS - "Avoid using escape=false unless ...
user avatar
4 votes
2 answers
202 views

Security Review - False Positive for SOQL Injection - Configuration Data (Input only by System Admin User)

I am using a dynamic query in one of our AppExchange products. There is an LWC component within our app, which has a property called filterLogic as below: <targetConfig targets="...
user avatar
  • 2,212

1
2 3 4 5
7