Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
1
vote
1answer
18 views

not checking for Id in FLS checks before query and DML [duplicate]

I am not checking for Id in FLS checks before query and DML. Is this a security review vulnerability in salesforce?
0
votes
1answer
32 views

Performing DML from a aura component's init handler [closed]

Performing DML from a aura component's init handler and the component is firing from a quick action of a record detail. Is this a security vulnerability for salesforce? Points to consider: The ...
0
votes
1answer
25 views

What are Aura: Aysnc Code and Sharing Violation vulnerabilities from the security review of the application(AppExchange)

I was creating an application to publish in app exchange and so I had submitted the application for security review but the report cointained:- We have completed the security review of your ...
0
votes
0answers
32 views

Getting “Lightning: CSS Outside Component” vulnerability in security review

As in salesforce security review report, it's mentioned that we should not use float or position: absolute or fixed. Uses non-standard positioning (via float or position: absolute or fixed) breaks ...
2
votes
1answer
16 views

Recommended explicit sharing declaration for inner classes

In our last Salesforce Security Review we have faced an issue related to the ommitted sharing declarations of inner classes acting as a wrapper. We have passed this review for years so I guess some ...
4
votes
1answer
91 views

Make Visualforce variable in Javascript pass Security Review

The following Javascript is embedded into a Visualforce page because it relies on Visualforce variables: <apex:page controller="myController" > <script> var foo1 =...
6
votes
1answer
151 views

Package review fails with new undocumented issues

My Managed package (yearly) Security Review failed with new issues I was not aware of and which I could not find documented anywhere, E.g.: Stored XSS - "Avoid using escape=false unless ...
0
votes
0answers
30 views

Where can we get appexchange before payment coupon codes?

I am about to submit my app for security review, in payment page i could see coupon code available. I would like to get one. so where can I get one coupon code ? Also from the security review video ...
2
votes
2answers
87 views

Security Review - False Positive for SOQL Injection - Configuration Data (Input only by System Admin User)

I am using a dynamic query in one of our AppExchange products. There is an LWC component within our app, which has a property called filterLogic as below: <targetConfig targets="...
3
votes
2answers
62 views

Filtering JavaScript out of HTML

A recent Salesforce Security review flagged the case of inserting this directly into a database text field: <h1>Hello</h1> <img src=x onerror=alert(document.cookie)> <h1>World&...
1
vote
1answer
43 views

Checkmarx Security Scanner FLS Issues

I run the checkmarx scanner for app and received ~250 FLS issues, which is understood, because when the app developed it simply was not checked. However I have noticed that there are lots of cases ...
0
votes
0answers
15 views

Manage Packages Listing With Dependency?

I am currently building a app to publish in market, done with with my development based on 2gp model, but I am confused on final listing for security review that, Which package needs to be on listing ...
1
vote
0answers
30 views

Will deprecated classes raise any security issues?

I submitted my managed package for a security review few days ago. After submitting, I found out that I don't have to use an Apex class in the package. So, I tried to delete that class but couldn't ...
2
votes
2answers
66 views

Consolidate Multiple Manage Packages With Dependency?

I am currently building a app to publish in market, done with with my development based on 2gp model, but I am confused on final package creation that Should i need to create single manage package ...
1
vote
1answer
44 views

Managed Package - Protected Custom Setting for storing creds - Security review

I have created a managed package where I used a protected Custom Setting of hierarchy type to store some user credentials. I am concerned about security review of the app. Is there any chances of ...
1
vote
1answer
105 views

Lightning - Security review problems

We are using the following css in one of our component. In security review it throws an error as follows. 1)Lightning: CSS Outside Component Code: .THIS.wrapper-app > lightning-spinner { ...
1
vote
1answer
58 views

Managed Package, Security Review and LWC DOM Manipulation

I started developing a managed package and I need to manipulate the DOM in a Lightning Web Component, In the component HTML, I added lwc:dom="manual" to the target element and everything ...
0
votes
0answers
65 views

Getting checkmarx FLS_Create Error in apex

Checkmarx is giving me the FLS_Create error in the below code. cv.PathOnClient = docName; cv.VersionData = requestbody; cv.ContentLocation = 'S'; cv....
5
votes
2answers
1k views

How to OWASP ZAP scan external REST API using OAuth2

I have built a Managed Package that talks to an external REST API using OAuth2 Named Credentials. I now want to submit this app for Security Review. I can't use the Chimera Scanner as it would require ...
0
votes
0answers
31 views

Has anyone used Lightning Out with a managed package?

I am working on an integration with a trading and rebalancing platform for a provider who also uses Salesforce Sales & Service cloud to manage their internal operations. This provider has added ...
1
vote
1answer
64 views

How to remove Salesforce CRUD Delete Security Risk?

When I scanned my app yesterday, and it raised a bunch of CRUD Delete security issue. So, I added isDeletable() check to all the delete query, and scanned it again. Still, it showed the same security ...
4
votes
1answer
175 views

Will an app where all the Apex is “without sharing” pass a Salesforce Security Review?

We are working on a portal app that will run inside a Community and the limited sharing rule capabilities of the lowest priced Communities licenses is making life difficult, particularly as this app ...
0
votes
1answer
131 views

Deploy FLS settings for standard object's custom field in managed package

I've added a custom field to Activity object for using it during Task creation/updating from Apex code. By default when I deploy my project through SFDX this field has no FLS settings. In the result I ...
0
votes
1answer
702 views

Restrict Access to @AuraEnabled Apex Methods for Authenticated Users Based on User Profile [closed]

This update is getting enforce in my org on the 5th of April 202o, since some of the updates in my org are having deactivation options after enforcement and some of them are not having. so I want to ...
1
vote
1answer
255 views

Is it necessary to check isUpdatable() when process run in system mode/trigger to pass security review process

In salesforce, we have a scenario, on the trigger of the lead object we are updating some records of Campaign. But the user on the behalf of we are running the trigger does not have edit permissions ...
3
votes
1answer
150 views

Endless loop of Chimera scans with failure

Today I started a Chimera scan from https://security.secure.force.com/sourcescanner/chimera__chimera_portal to scan an external API we use in an ISV app which is going into Security Review soon. ...
1
vote
1answer
1k views

Secure Object Permissions for Guest Users (Security Alert) May 2020

I am a little bit confused with this security alert that will take place in May of 2020. Within the sandbox they only list 3 objects, where this update will be affected Contracts, Order, and ...
2
votes
2answers
48 views

SF Lightning and Angular (versions 7) — Any concerns on the App Exchange

I am trying to write an application in SF Lightning that uses angular (not angularjs, angular, version 7 if it matters) as the front end. To handle this (since it truly is a separate app that is ...
0
votes
0answers
53 views

Cross-Site Scripting in visual force input

We have received a security warning regarding Cross-Site Scripting for below input : <apex:inputtext value="{!mergeText}" id="txtField" disabled="true" size="25"/> What changes are required to ...
0
votes
1answer
115 views

Managed package and security review

We have developed a solution that we want to distribute as ISV on AppExchange. What happens if we have people install those packages while they are in review? Do customers need to reinstall our ...
7
votes
3answers
1k views

Do we need to check CRUD permissions on custom metadata type/custom setting to pass the AppExchange security review

I have an application that we need to upload on AppExchnage but we need to pass the security review so I have a query on the custom metadata type so do we need to check the isAccessible() permission ...
2
votes
1answer
59 views

Do we have to force all FFLIB classes with `with sharing` keywords to pass security review?

I'm using FFLIB classes in my managed package and i just wanted to know if i should mark FFLIB classes use in my package with with sharing keyword to follow security review requirements ? Thanks,
2
votes
2answers
108 views

Connected App consumerKey Security Review issue

We have two connected apps that are part of a managed package that is up for review. One app is used for API access to Salesforce from an external web platform, and the other is used as a CanvasApp ...
-1
votes
1answer
125 views

CRUD/FLS checks on Dynamic SOQL - Needed for WHERE clause? [duplicate]

For the AppExchange Security Review, do we need to check FLS on a Dynamic SOQL WHERE clause as well? Ex: If Contact.My_Custom_Field__c is not visible to the logged in user, then the following SOQL ...
3
votes
1answer
110 views

Do I need to define sharing for test classes?

The question is simple: should test classes be defined with sharing with sharing | without sharing | inherited sharing to pass the security review? Technically Salesforce enforces this by saying it ...
3
votes
2answers
179 views

Do I need to define sharing for inner classes?

In preparation to Security Review I am checking that all my classes follow instructions from Sharing in Apex Classes. Now I am wondering do inner classes also need to be defined as with sharing | ...
11
votes
4answers
1k views

How to best enforce CRUD/FLS and pass Security Review

Since Salesforce began to require CRUD / FLS checks as part of the Security Review for AppEchange apps in 2015 there has been a lot of discussions why this cannot be done by the platform and how this ...
5
votes
1answer
181 views

Is Jest mandatory in LWC For appExchange app

As SF stated Jest is independent of Salesforce and doesn't run in web browser. Is it mandatory to write coverage/unit testing for Lightning Web Components and add in bundle while creating manage ...
5
votes
0answers
94 views

Auth. Providers and Named Credentilas for Salesforce Security Review

We have managed package, where in we are asking users to configure Auth. Providers,Named Credentials after package installation as user might need to change endpoint when user have to connect to ...
5
votes
3answers
380 views

Second-Generation Managed Package Security Review

Generally, the question stands as what steps need to be done in order to send 2-nd generation managed package for security review. Current conditions: I have developed 2-nd generation managed ...
3
votes
0answers
103 views

Integrate external app using IFrame (not Canvas) and Security review

I have a customer that wants to integrate an external Java App with a Managed Package. As the endpoint (domain name) of the external Java App(s) is not static but differs from customer to customer we ...
5
votes
0answers
26 views

Does lightning beta tags pass security review? [duplicate]

There is lightning:tabset and lightning:tab tags which are still in beta as of now. If we use them while developing an app exchange product do they pass security review? Can we use them in production?
-1
votes
1answer
38 views

Publish App exchange application with Scanning [duplicate]

I have created a Lightning component And Add in App Exchange my partner community. So I have passed my component in a security review. Now I can use SOURCE SCANNER for Apex class and visual force ...
2
votes
0answers
31 views

How to register an external app in appexchange marketplace

We have an external .net application which connects into SF using API. We want to sell this app on appexchange. What are steps that need to be taken to list it on appexchange? How does the security ...
4
votes
1answer
270 views

Apex Source Scanner flag CRUD/ FLS as security risk for no reason

I've been using FFLIB_SecurityUtils lib to enforce CRUD and FLS in my apex classes. I've no issues when running unit tests, but when submitting my code on Source Scanner for partners, i've several ...
4
votes
0answers
53 views

Force.com Site and custom user authorization - Is it allowed and when? [duplicate]

Assume I am going to build a customer facing website where users have some access to Salesforce Standard and custom objects. Because it's expensive I don't want to give them Salesforce licenses. I ...
3
votes
3answers
220 views

Public Salesforce Site and Security Review

Let's face it. Salesforce Communities is expensive and not for everyone out there. I have a customer who wants to create a customer-facing site where non-logged in users can register themselves and ...
0
votes
2answers
528 views

Locker Service and 3rd party library, how to pass Security review?

Is it a way to use 3rd party library/framework like Vue/Angular and bypass security review by Salesforce. Because only option to use those kind of library seems possible with version 39.0 which is ...
2
votes
0answers
93 views

Javascript in Static Resources for security review but requires parameter

I have a package that was submitted for security review which requires JS to be in static resources. Required: all script and style resources must be loaded through static resources Do not load ...
1
vote
1answer
117 views

Remove Sample Code references in Managed package metadata

One of our partners reached out to us in helping their package pass security review. The recent report they received contains the following issue: Sample Code in Production Account.object Issue ...

1
2 3 4 5 6