Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
2
votes
2answers
65 views

SessionID access vulnerability found when using Metadata API

Salesforce is performing manual security review in our package. They have found SessionID access Vulnerability in one of our file where we are using Metadata API to grant permissions on profile and ...
0
votes
1answer
32 views

Passing Client Id and Client Secret in URL as Encrypted String for AppExchange App

We are developing an AppExchange application which integrates with external application .Every customer has a connected app because of different branding and different and different callback URLs. ...
3
votes
0answers
38 views

lightning:container performance/security and why no alternative in LWC [closed]

Is there any specific reason as to why salesforce has not provided the equivalent of lightning:container in LWC ? Since lightning:container places the component in an iFrame, is it good to use it (in ...
0
votes
2answers
45 views

URL Redirection Attack - Source Scanner Results

I have got Query: URL Redirection Attack during Source Scanner. Piece of controller @AuraEnabled public static String forgotPassword(String username, String checkEmailUrl) { try { Site....
1
vote
2answers
26 views

Security review for a managed package with Polymorphic SOQL queries

I checked the documentation "Enable Field- and Object-Level Permissions Checking Using WITH SECURITY_ENFORCED in SOQL Queries". But looks like the below query won't work because traversing a ...
1
vote
1answer
23 views

Aura:html tags in component flagged in Security Review

We have received Security review issues for <aura:html tag="style"> used in Lightning component .cmp file. This was done to change the modal width which is opened from Quick Action. &...
0
votes
0answers
22 views

Not able to reproduce checkmarx scann results using SFDX scanner

We got these below eeors when we submitter our code for security review in salesforce portal In order to fix the issue we are trying to replicate the issues using SFDX scanner in our local but SFDX ...
0
votes
1answer
20 views

CxSAST URL for VSCode

We are trying to host our application in Appexchange. So before submitting we did scan code review in security portal of salesforce and got some errors. We are trying to fix those issues in our local ...
0
votes
0answers
11 views

Code Scanner Portal show error in browser console

I try do security scanner for our code. I use this "Force.com Code Scanner Portal" website to do it. This is the website link: https://security.secure.force.com/security/tools/forcecom/...
0
votes
1answer
67 views

SessionId in LWC for Security Review

I am using this workaround to get the SessionId in my LWC and perform a callout from the JS. I am concerned about if it will pass the security review for managed packages. Have someone used it and can ...
0
votes
0answers
67 views

Issue with Chimera Scans - Chimera abuse prevention token

Chimera scan is not working properly. The token file is located correctly, I checked the file location using the site url and I can access the token file. But the scan is still complaining with the ...
11
votes
0answers
80 views

Is there a reliable way to have WITH SECURITY_ENFORCED applied to all queries?

I've just gone through a biggish code base making sure that WITH SECURITY_ENFORCED is set on every query. Most were, but for some recent additions, it hadn't been included. For managed packages that ...
1
vote
1answer
34 views

Query: Password APIs Issue on Salesforce Security Report

We have a scenario to allow the user to reset the password for the community users, We have used the following snippet System.resetPassword(userId, true); So its blocked in the security report under ...
0
votes
0answers
137 views

Content Security Policy: Wildcard Directive

For a security review, I ran ZAP scanner on my application (Salesforce URL) and it is reflecting some security issues. The description for CSP issue is as follows: The following directives either ...
0
votes
1answer
30 views

Update Lightning API Version

I need to update lightning API version to 40 or more for Open CTI components as it is the requirement of security review. Currently, I have version 38.0. I wanted to know how can I update API version. ...
1
vote
0answers
29 views

Callable : Can we call class methods from different managed package without using namespace?

CALLABLE Enables developers to use a common interface to build loosely coupled integrations between Apex classes or triggers, even for code in separate packages. I have created an LWC component and ...
0
votes
0answers
41 views

getting Client DOM Code Injection security issue in lightning controller

In scanning, I got Client DOM Code Injection security issue in lightning controller for below section: window.addEventListener("message", function(event) { var message = event.data; }, false)...
1
vote
1answer
40 views

Force.com Source Scanner Results: FLS Update and Create

I've run the Force.com Source Scanner against my Managed Package and here are the summary results: There are two areas FLS Update and FLS Create where I got 28, and 37 risks respectively... I am ...
0
votes
1answer
113 views

SECURITY ENFORCED exception in Rest Callback

I've added the WITH SECURITY_ENFORCED clause to my SOQL query. The query is present at a Rest service for a callback so I am testing it by creating a public site will create a profile (External Users ...
0
votes
2answers
48 views

Can I perform DML operation via apex (system context) on object where logged in profile user never have access?

Will it be a problem to perform DML on an object where the user never have access? Will it lead to salesforce audit violation kind of thing if I implement this? Use Case: Trying to perform DML ...
1
vote
1answer
22 views

not checking for Id in FLS checks before query and DML [duplicate]

I am not checking for Id in FLS checks before query and DML. Is this a security review vulnerability in salesforce?
0
votes
1answer
27 views

What are Aura: Aysnc Code and Sharing Violation vulnerabilities from the security review of the application(AppExchange)

I was creating an application to publish in app exchange and so I had submitted the application for security review but the report cointained:- We have completed the security review of your ...
1
vote
0answers
68 views

Getting “Lightning: CSS Outside Component” vulnerability in security review

As in salesforce security review report, it's mentioned that we should not use float or position: absolute or fixed. Uses non-standard positioning (via float or position: absolute or fixed) breaks ...
2
votes
1answer
24 views

Recommended explicit sharing declaration for inner classes

In our last Salesforce Security Review we have faced an issue related to the ommitted sharing declarations of inner classes acting as a wrapper. We have passed this review for years so I guess some ...
4
votes
1answer
111 views

Make Visualforce variable in Javascript pass Security Review

The following Javascript is embedded into a Visualforce page because it relies on Visualforce variables: <apex:page controller="myController" > <script> var foo1 =...
6
votes
1answer
170 views

Package review fails with new undocumented issues

My Managed package (yearly) Security Review failed with new issues I was not aware of and which I could not find documented anywhere, E.g.: Stored XSS - "Avoid using escape=false unless ...
0
votes
0answers
70 views

Where can we get appexchange before payment coupon codes?

I am about to submit my app for security review, in payment page i could see coupon code available. I would like to get one. so where can I get one coupon code ? Also from the security review video ...
4
votes
2answers
150 views

Security Review - False Positive for SOQL Injection - Configuration Data (Input only by System Admin User)

I am using a dynamic query in one of our AppExchange products. There is an LWC component within our app, which has a property called filterLogic as below: <targetConfig targets="...
3
votes
2answers
112 views

Filtering JavaScript out of HTML

A recent Salesforce Security review flagged the case of inserting this directly into a database text field: <h1>Hello</h1> <img src=x onerror=alert(document.cookie)> <h1>World&...
1
vote
1answer
84 views

Checkmarx Security Scanner FLS Issues

I run the checkmarx scanner for app and received ~250 FLS issues, which is understood, because when the app developed it simply was not checked. However I have noticed that there are lots of cases ...
0
votes
0answers
15 views

Manage Packages Listing With Dependency?

I am currently building a app to publish in market, done with with my development based on 2gp model, but I am confused on final listing for security review that, Which package needs to be on listing ...
1
vote
0answers
32 views

Will deprecated classes raise any security issues?

I submitted my managed package for a security review few days ago. After submitting, I found out that I don't have to use an Apex class in the package. So, I tried to delete that class but couldn't ...
2
votes
2answers
73 views

Consolidate Multiple Manage Packages With Dependency?

I am currently building a app to publish in market, done with with my development based on 2gp model, but I am confused on final package creation that Should i need to create single manage package ...
1
vote
1answer
50 views

Managed Package - Protected Custom Setting for storing creds - Security review

I have created a managed package where I used a protected Custom Setting of hierarchy type to store some user credentials. I am concerned about security review of the app. Is there any chances of ...
1
vote
1answer
186 views

Lightning - Security review problems

We are using the following css in one of our component. In security review it throws an error as follows. 1)Lightning: CSS Outside Component Code: .THIS.wrapper-app > lightning-spinner { ...
1
vote
1answer
87 views

Managed Package, Security Review and LWC DOM Manipulation

I started developing a managed package and I need to manipulate the DOM in a Lightning Web Component, In the component HTML, I added lwc:dom="manual" to the target element and everything ...
0
votes
0answers
109 views

Getting checkmarx FLS_Create Error in apex

Checkmarx is giving me the FLS_Create error in the below code. cv.PathOnClient = docName; cv.VersionData = requestbody; cv.ContentLocation = 'S'; cv....
5
votes
2answers
2k views

How to OWASP ZAP scan external REST API using OAuth2

I have built a Managed Package that talks to an external REST API using OAuth2 Named Credentials. I now want to submit this app for Security Review. I can't use the Chimera Scanner as it would require ...
1
vote
1answer
121 views

How to remove Salesforce CRUD Delete Security Risk?

When I scanned my app yesterday, and it raised a bunch of CRUD Delete security issue. So, I added isDeletable() check to all the delete query, and scanned it again. Still, it showed the same security ...
4
votes
1answer
182 views

Will an app where all the Apex is “without sharing” pass a Salesforce Security Review?

We are working on a portal app that will run inside a Community and the limited sharing rule capabilities of the lowest priced Communities licenses is making life difficult, particularly as this app ...
0
votes
1answer
270 views

Deploy FLS settings for standard object's custom field in managed package

I've added a custom field to Activity object for using it during Task creation/updating from Apex code. By default when I deploy my project through SFDX this field has no FLS settings. In the result I ...
0
votes
1answer
719 views

Restrict Access to @AuraEnabled Apex Methods for Authenticated Users Based on User Profile [closed]

This update is getting enforce in my org on the 5th of April 202o, since some of the updates in my org are having deactivation options after enforcement and some of them are not having. so I want to ...
1
vote
1answer
502 views

Is it necessary to check isUpdatable() when process run in system mode/trigger to pass security review process

In salesforce, we have a scenario, on the trigger of the lead object we are updating some records of Campaign. But the user on the behalf of we are running the trigger does not have edit permissions ...
3
votes
1answer
193 views

Endless loop of Chimera scans with failure

Today I started a Chimera scan from https://security.secure.force.com/sourcescanner/chimera__chimera_portal to scan an external API we use in an ISV app which is going into Security Review soon. ...
1
vote
1answer
1k views

Secure Object Permissions for Guest Users (Security Alert) May 2020

I am a little bit confused with this security alert that will take place in May of 2020. Within the sandbox they only list 3 objects, where this update will be affected Contracts, Order, and ...
2
votes
2answers
56 views

SF Lightning and Angular (versions 7) — Any concerns on the App Exchange

I am trying to write an application in SF Lightning that uses angular (not angularjs, angular, version 7 if it matters) as the front end. To handle this (since it truly is a separate app that is ...
0
votes
0answers
88 views

Cross-Site Scripting in visual force input

We have received a security warning regarding Cross-Site Scripting for below input : <apex:inputtext value="{!mergeText}" id="txtField" disabled="true" size="25"/> What changes are required to ...
0
votes
1answer
201 views

Managed package and security review

We have developed a solution that we want to distribute as ISV on AppExchange. What happens if we have people install those packages while they are in review? Do customers need to reinstall our ...
8
votes
3answers
2k views

Do we need to check CRUD permissions on custom metadata type/custom setting to pass the AppExchange security review

I have an application that we need to upload on AppExchnage but we need to pass the security review so I have a query on the custom metadata type so do we need to check the isAccessible() permission ...
2
votes
1answer
65 views

Do we have to force all FFLIB classes with `with sharing` keywords to pass security review?

I'm using FFLIB classes in my managed package and i just wanted to know if i should mark FFLIB classes use in my package with with sharing keyword to follow security review requirements ? Thanks,

1
2 3 4 5 6