Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
5 votes
2 answers
245 views

Are custom SOQL and DML libs superfluous with USER MODE?

As the Security model of Apex was leaky in the past, everybody who took - or as AppExchange Partners had to take - Security seriously was building or using libraries to enforce CRUD/FLS rules. The ...
3 votes
1 answer
106 views

Security Review Test Environment - how many users for Salesforce?

Until today I believed that you need to provide at least TWO users to Salesforce to test your app in the Test Environment you submit for Security Review. I tried to find that rule in an official ...
0 votes
1 answer
59 views

When is the External Service Scan required in Salesforce Security Review?

I am currently working with a Salesforce integration in which a third-party system creates/updates records in the Salesforce org using the native REST API of Salesforce. It is a unidirectional ...
1 vote
1 answer
32 views

Self certify that the package is lightning ready

How do I certify that my package is Lightning ready? Is that something that we have to raise the case with the community? In the checklist, it shows that I have to "Self-certify listing as ...
  • 328
1 vote
1 answer
60 views

Salesforce package version creation after resolving the errors

We are planning to publish the package to the appexchange security review process before which we have run through a security scan. The package version is 0.1.0-1. After resolving the errors from the ...
  • 328
1 vote
0 answers
31 views

Checkmarx reporting wrong function name?

I just ran a Checkmarx scan today. It reported the following Apex Serious Security Risk: You can see the report is making a reference to isCreatable(). However, the name of the method in my Apex code ...
  • 302
1 vote
0 answers
29 views

'Select Listing Name to Scan' is empty in the Partner Security Portal

As mentioned by @phil in Sending review to the checkmarx where multiple developments are included I have gone to partner security portal. Though the packages are being displayed in the partner ...
  • 328
0 votes
1 answer
23 views

Sending review to the checkmarx where multiple developments are included

I have a org that is connected to the partner community. In this org, there are managed packages, unmanaged packages, and various other developments that includes code that is not required for the ...
  • 328
0 votes
0 answers
19 views

How to scan the Second Generation managed package code on Checkmarx Scanner from Partner Security Portal

I have created a second generation managed package using the dev hub org and namespace org and I have connected the dev hub org in the organizations subtab in publishing tab. But when I tried to login ...
  • 1
1 vote
0 answers
49 views

What does the Dereferenced Field vulnerability in Security Review scan means?

I've received a vulnerability from Checkmarx scan that is labelled as Dereferenced Field vulnerability. The scan report message reads like this: A possible dereference exist in method uploadDocument. ...
  • 5,768
2 votes
0 answers
55 views

Why & How to use Burp Suite for Salesforce External Services

I am investigating the possibility of using Burp as an alternative to Chimera or OWASP Zap to provide a scan report of an External Service in the Salesforce Security Review. The information that I am ...
0 votes
1 answer
39 views

Managed Package Yearly Security Review

I was under the assumption that after 1 year a managed package should again go thru security review. However I published a free app that passed the security review at 26-1-2022. Since then I published ...
  • 1,659
0 votes
2 answers
37 views

Using SOQL Injection to delete data

I know that SOQL injection can be used to query data the user shouldn't see by providing a value like Bob \' OR Name LIKE '%'. But I'm wondering if you could use an input value like Name LIKE '%')'; ...
  • 153
1 vote
0 answers
63 views

Transport False-Positive comments to Checkmarx report

I want to find the best way to address false positives in the Checkmarx report. One of the points I am investigating is how to make the Checkmarx report to display the false positive comment that has ...
0 votes
0 answers
69 views

Client DOM Code Injection in Lightning Aura Component

The security scanner alert us about client DOM code injection on this lines: L 3: var orgin = window.location.origin; L 4: component.set("v.orgin",orgin); L 5: window.addEventListener("...
  • 1
8 votes
0 answers
201 views

Fail Security Review again and again. New process?

I am aware that Salesforce recently changed some rules for Security Review, which makes the life of ISV and PDO partners harder. Here is another one that I am seeing, and ask for some guidance. In the ...
0 votes
0 answers
33 views

Salesforce AppExchange - free integration to paid platform

We have a web app that we license per user per month (paid annually). We also built a Salesforce Managed Package that allows Salesforce users to work with our UI inside of iframes on the Opportunity ...
0 votes
0 answers
15 views

Is MFA for Appexchange Test Drive An Issue?

Submitted a Test Drive for our ISV application to Security Review and got failure because IP Address ranges are too wide, 0.0.0.0 - 255.255.255.255. I thought this was bad advice also but it's in our ...
  • 1,486
35 votes
5 answers
2k views

Call Salesforce API from Apex and not fail Security Review

For years I have used Salesforce APIs from within Apex. Mostly to enhance my apps with Setup automation. So I used the Tooling and Metadata API from code snippets that used UserInfo.getSessionId() and ...
-1 votes
1 answer
90 views

What happens when Password setting is updated?

I am trying to improve our Salesforce Org Health Check score. I have one setting "Password complexity requirement" where current value is "Must include alpha and numeric characters"...
  • 89
0 votes
0 answers
22 views

How to set isExposed of messagechannel component of released package but not yet approved from security review?

My app has gone through security review for the first time and they failed it stating that the messaging channel component has isExposed to true and that it should be set to false. Now when I try to ...
  • 121
1 vote
1 answer
81 views

If you break ancestry, would you have to start security process from scratch?

If you break ancestry, would you have to start security process from scratch? I know that if you want to create a package from a different dev hub, you would have to restart the security review ...
  • 14.7k
1 vote
2 answers
60 views

What type of product am I submitting for security review?

I am about to submit my Salesforce package (2GP) for security review, and clicking "Start Review" in the Partner Community portal prompts me with a choice: What type of product are you ...
0 votes
1 answer
49 views

How to resolve SOQL SOSL Injection security error

I am fairly new to salesforce. I am getting the soql sosl injection error in the below method while doing query. How to resolve this error? public static Days_Unavailable__c getAvlRecordById(String ...
  • 15
0 votes
1 answer
103 views

How do I submit a 2nd generation managed package for security review?

I am trying to get 2nd generation managed package ready for security review. It is not showing up in the devhub org. How do I submit the package. Do I zip up the source code and submit it? I have ...
  • 121
0 votes
0 answers
30 views

Should I release / promote managed 2nd generation before security review or after security review?

Should I release / promote managed 2nd generation before security review or after security review? I am ready for security review but I am confused if I should use the beta versions that I have been ...
  • 121
1 vote
0 answers
73 views

Access to Security Portal (Scanner) when building 2GP

I work as a PDO partner for a customer who wants to have an app on App Exchange. We develop a 2GP package, where Dev Hub is located in the customer PBO, which is linked as an organization to App ...
0 votes
1 answer
59 views

Is fixing "Apex Code Quality" issues necessary for passing security review?

I have fixed all the "Apex Critical Security Risk" issues but there are few apex code quality issues remaining. Some of them are false positives and some are correct. But due to time ...
  • 3,355
1 vote
1 answer
135 views

Security Review: Cloud Service uses and stores OAuth tokens

My customer runs a Cloud Service for many years, that connects with Salesforce orgs via OAuth flow and stores org tokens in its database. As this service wasn't on the AppExchange my customer did not ...
-1 votes
1 answer
28 views

Which Salesforce scanner tool can I use to scan Chrome Extension(built on Angular utilizing Salesforce APIs)?

We have a Chrome Extension built upon Angular utilizing Salesforce APIs, now We want to publish it on APP Exchange, so we have to upload a scanner report, which scanner tool can we use? I tried using ...
3 votes
1 answer
233 views

Resubmit for Security Review without Patches

I am working for an existing AppExchange ISV Partner that missed the deadlines for Security Review resubmission. When that happens Salesforce is not only taking your Listing down but also deactivating ...
6 votes
1 answer
195 views

Best (commercial) Scanner to stay prepared for Security Review

For ISVs to be safe to (re)submit their app for Security Review without issues Checkmarx still is the only authoritative tool. But it is also cumbersome and limited as: Community Scanner is limited ...
1 vote
0 answers
148 views

Run Checkmarx on code not in packaging org (too big for Community scanner)

I am consulting an ISV partner with their resubmission of the Salesforce Security Review. They ran the initial Checkmarx scan using the Partner Scanner on the code in their Packaging org, then fixed ...
0 votes
0 answers
22 views

Unable to begin Security Review

I have a lightning App which I have scanned using the Checkmarx app, along with a scan with ZAP. However, when I go to the security review tab, the Start Review button is greyed out and the Update ...
5 votes
4 answers
760 views

How different is Initial Security Review from Resubmission

An ISV customer of mine has a Managed Package in the AppExchange for many years now. He recently was asked to resubmit for Security Review and is now wondering what to expect and how to best plan and ...
0 votes
1 answer
31 views

SOAP Web API scan for underlying API undder my salesforce app

we are using the web API (SOAP) as a backend in our salesforce app. Do I need to attach the ZAP/Burp or Chimera report with my submit material ? or these reports are only required for WebAppliaction . ...
0 votes
1 answer
40 views

security review payment needed every time a different package is submitted?

does every time I submit a package for review the review fee has to be paid? Or is it just once per year?
  • 302
2 votes
0 answers
79 views

How to avoid using position:absolute in stylesheets for aura components due to security concerns as mentioned in the ISV guide

I'm trying to pass security review for my managed package. I have to a security issue to address: Unsafe CSS position declaration: position: absolute; The Salesforce Platform tries to ensure that ...
2 votes
0 answers
58 views

Possibility to Install a managed package on production while package is under Security Review

We are working on a managed package, which we are planning to submit for security review in a few weeks. While the package will be in the security review, we would also like to install the managed ...
  • 2,342
0 votes
1 answer
104 views

VfUnescapeEl PMD fix for salesforce static resource page

We are getting VfUnescapeEl error in our sfdx report on the following line : <a href="{!LEFT($CurrentPage.URL,FIND('/',$CurrentPage.URL,9))}{{x.Id}}">...</a> here, x.id will be ...
  • 1
0 votes
1 answer
192 views

Necessity to resolve all PMD issues for security review

We generated a pmd report using sfdx, is it necessary to resolve all the sfdx report issues to pass the salesforce security review or those are just warnings and can be ignored to pass the security ...
0 votes
1 answer
47 views

Does Upgrading Major Version Number Trigger Security Review

We're rolling out a larger change in our manage package and it would be nice to recognise these changes by increasing the Major version number on our package. The concern is whether it will trigger a ...
0 votes
1 answer
239 views

Why newly released package version is not available in Partner Security Portal scanner?

We have released a new minor 2GMP release version and try to check it for Security and Quality rules in Partner Security Portal scanner, but the new version doesn't show up in the picklist for Select ...
  • 14.7k
1 vote
1 answer
88 views

Pass SF security review and keep <apex:pageMessages escape="false"/> in a visualforce page

to pass security review we must avoid <apex:pageMessages escape="false"/> But without the escape="false", my message will not be clickable anymore. So inside my controller, I ...
  • 11
2 votes
1 answer
79 views

Risks & Benefits of Installing Someone Else's Unlocked 2nd Gen Package

I'm interested in introducing a GitHub project into our enterprise org. That GitHub project currently offers the tool in both Managed Package and Unlocked Package format. The Unlocked Package format ...
0 votes
1 answer
56 views

Is it a liability to use the lightning container npm package? (not been updated for 4 years...)

I have embedded my react app in a lightning container iframe as the docs suggest. <aura:component access="global" implements="flexipage:availableForAllPageTypes"> <...
  • 1
1 vote
1 answer
1k views

URL Redirect Attack - Apex

I have been trying to fix the below URL Redirection Attack code block but couldn't find a working solution: String url = '/' + oGenericObj.getDescribe().getKeyPrefix() + '/e'; ...
-2 votes
1 answer
313 views

Security Scanner Report in Owasp zap

How to scan my salesforce app in Owasap zap, need to cover everything such as custom objects, flow, process builder, reports and dashboard, etc. at the end need to generate a report, is possible?
2 votes
0 answers
118 views

Information Disclosure Vulnerability

Here is a security vulnerability issue of "Information Disclosure" reported by the Salesforce Team. URL https://yourdomain.lightning.force.com/aura?r=13&aura.DynamicComponent....
  • 397
1 vote
1 answer
168 views

Is there any way to set feature parameters for beta versions which did not pass security review?

Is there any way set feature parameters for package beta versions which did not pass security review? Assuming you are going to release a new version of package which will include feature parameters. ...
  • 14.7k

1
2 3 4 5
7