Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
0
votes
0answers
17 views

Issue with Chimera Scans - Chimera abuse prevention token

Chimera scan is not working properly. The token file is located correctly, I checked the file location using the site url and I can access the token file. But the scan is still complaining with the ...
10
votes
0answers
61 views

Is there a reliable way to have WITH SECURITY_ENFORCED applied to all queries?

I've just gone through a biggish code base making sure that WITH SECURITY_ENFORCED is set on every query. Most were, but for some recent additions, it hadn't been included. For managed packages that ...
1
vote
1answer
27 views

Query: Password APIs Issue on Salesforce Security Report

We have a scenario to allow the user to reset the password for the community users, We have used the following snippet System.resetPassword(userId, true); So its blocked in the security report under ...
0
votes
0answers
38 views

Content Security Policy: Wildcard Directive

For a security review, I ran ZAP scanner on my application (Salesforce URL) and it is reflecting some security issues. The description for CSP issue is as follows: The following directives either ...
0
votes
1answer
24 views

Update Lightning API Version

I need to update lightning API version to 40 or more for Open CTI components as it is the requirement of security review. Currently, I have version 38.0. I wanted to know how can I update API version. ...
1
vote
0answers
24 views

Callable : Can we call class methods from different managed package without using namespace?

CALLABLE Enables developers to use a common interface to build loosely coupled integrations between Apex classes or triggers, even for code in separate packages. I have created an LWC component and ...
0
votes
0answers
34 views

getting Client DOM Code Injection security issue in lightning controller

In scanning, I got Client DOM Code Injection security issue in lightning controller for below section: window.addEventListener("message", function(event) { var message = event.data; }, false)...
0
votes
1answer
27 views

Force.com Source Scanner Results: FLS Update and Create

I've run the Force.com Source Scanner against my Managed Package and here are the summary results: There are two areas FLS Update and FLS Create where I got 28, and 37 risks respectively... I am ...
0
votes
1answer
59 views

SECURITY ENFORCED exception in Rest Callback

I've added the WITH SECURITY_ENFORCED clause to my SOQL query. The query is present at a Rest service for a callback so I am testing it by creating a public site will create a profile (External Users ...
0
votes
2answers
39 views

Can I perform DML operation via apex (system context) on object where logged in profile user never have access?

Will it be a problem to perform DML on an object where the user never have access? Will it lead to salesforce audit violation kind of thing if I implement this? Use Case: Trying to perform DML ...
1
vote
1answer
20 views

not checking for Id in FLS checks before query and DML [duplicate]

I am not checking for Id in FLS checks before query and DML. Is this a security review vulnerability in salesforce?
0
votes
1answer
25 views

What are Aura: Aysnc Code and Sharing Violation vulnerabilities from the security review of the application(AppExchange)

I was creating an application to publish in app exchange and so I had submitted the application for security review but the report cointained:- We have completed the security review of your ...
0
votes
0answers
46 views

Getting “Lightning: CSS Outside Component” vulnerability in security review

As in salesforce security review report, it's mentioned that we should not use float or position: absolute or fixed. Uses non-standard positioning (via float or position: absolute or fixed) breaks ...
2
votes
1answer
23 views

Recommended explicit sharing declaration for inner classes

In our last Salesforce Security Review we have faced an issue related to the ommitted sharing declarations of inner classes acting as a wrapper. We have passed this review for years so I guess some ...
4
votes
1answer
103 views

Make Visualforce variable in Javascript pass Security Review

The following Javascript is embedded into a Visualforce page because it relies on Visualforce variables: <apex:page controller="myController" > <script> var foo1 =...
6
votes
1answer
157 views

Package review fails with new undocumented issues

My Managed package (yearly) Security Review failed with new issues I was not aware of and which I could not find documented anywhere, E.g.: Stored XSS - "Avoid using escape=false unless ...
0
votes
0answers
49 views

Where can we get appexchange before payment coupon codes?

I am about to submit my app for security review, in payment page i could see coupon code available. I would like to get one. so where can I get one coupon code ? Also from the security review video ...
4
votes
2answers
132 views

Security Review - False Positive for SOQL Injection - Configuration Data (Input only by System Admin User)

I am using a dynamic query in one of our AppExchange products. There is an LWC component within our app, which has a property called filterLogic as below: <targetConfig targets="...
3
votes
2answers
73 views

Filtering JavaScript out of HTML

A recent Salesforce Security review flagged the case of inserting this directly into a database text field: <h1>Hello</h1> <img src=x onerror=alert(document.cookie)> <h1>World&...
1
vote
1answer
50 views

Checkmarx Security Scanner FLS Issues

I run the checkmarx scanner for app and received ~250 FLS issues, which is understood, because when the app developed it simply was not checked. However I have noticed that there are lots of cases ...
0
votes
0answers
15 views

Manage Packages Listing With Dependency?

I am currently building a app to publish in market, done with with my development based on 2gp model, but I am confused on final listing for security review that, Which package needs to be on listing ...
1
vote
0answers
31 views

Will deprecated classes raise any security issues?

I submitted my managed package for a security review few days ago. After submitting, I found out that I don't have to use an Apex class in the package. So, I tried to delete that class but couldn't ...
2
votes
2answers
70 views

Consolidate Multiple Manage Packages With Dependency?

I am currently building a app to publish in market, done with with my development based on 2gp model, but I am confused on final package creation that Should i need to create single manage package ...
1
vote
1answer
44 views

Managed Package - Protected Custom Setting for storing creds - Security review

I have created a managed package where I used a protected Custom Setting of hierarchy type to store some user credentials. I am concerned about security review of the app. Is there any chances of ...
1
vote
1answer
144 views

Lightning - Security review problems

We are using the following css in one of our component. In security review it throws an error as follows. 1)Lightning: CSS Outside Component Code: .THIS.wrapper-app > lightning-spinner { ...
1
vote
1answer
73 views

Managed Package, Security Review and LWC DOM Manipulation

I started developing a managed package and I need to manipulate the DOM in a Lightning Web Component, In the component HTML, I added lwc:dom="manual" to the target element and everything ...
0
votes
0answers
85 views

Getting checkmarx FLS_Create Error in apex

Checkmarx is giving me the FLS_Create error in the below code. cv.PathOnClient = docName; cv.VersionData = requestbody; cv.ContentLocation = 'S'; cv....
5
votes
2answers
2k views

How to OWASP ZAP scan external REST API using OAuth2

I have built a Managed Package that talks to an external REST API using OAuth2 Named Credentials. I now want to submit this app for Security Review. I can't use the Chimera Scanner as it would require ...
0
votes
0answers
35 views

Has anyone used Lightning Out with a managed package?

I am working on an integration with a trading and rebalancing platform for a provider who also uses Salesforce Sales & Service cloud to manage their internal operations. This provider has added ...
1
vote
1answer
84 views

How to remove Salesforce CRUD Delete Security Risk?

When I scanned my app yesterday, and it raised a bunch of CRUD Delete security issue. So, I added isDeletable() check to all the delete query, and scanned it again. Still, it showed the same security ...
4
votes
1answer
180 views

Will an app where all the Apex is “without sharing” pass a Salesforce Security Review?

We are working on a portal app that will run inside a Community and the limited sharing rule capabilities of the lowest priced Communities licenses is making life difficult, particularly as this app ...
0
votes
1answer
212 views

Deploy FLS settings for standard object's custom field in managed package

I've added a custom field to Activity object for using it during Task creation/updating from Apex code. By default when I deploy my project through SFDX this field has no FLS settings. In the result I ...
0
votes
1answer
713 views

Restrict Access to @AuraEnabled Apex Methods for Authenticated Users Based on User Profile [closed]

This update is getting enforce in my org on the 5th of April 202o, since some of the updates in my org are having deactivation options after enforcement and some of them are not having. so I want to ...
1
vote
1answer
399 views

Is it necessary to check isUpdatable() when process run in system mode/trigger to pass security review process

In salesforce, we have a scenario, on the trigger of the lead object we are updating some records of Campaign. But the user on the behalf of we are running the trigger does not have edit permissions ...
3
votes
1answer
178 views

Endless loop of Chimera scans with failure

Today I started a Chimera scan from https://security.secure.force.com/sourcescanner/chimera__chimera_portal to scan an external API we use in an ISV app which is going into Security Review soon. ...
1
vote
1answer
1k views

Secure Object Permissions for Guest Users (Security Alert) May 2020

I am a little bit confused with this security alert that will take place in May of 2020. Within the sandbox they only list 3 objects, where this update will be affected Contracts, Order, and ...
2
votes
2answers
49 views

SF Lightning and Angular (versions 7) — Any concerns on the App Exchange

I am trying to write an application in SF Lightning that uses angular (not angularjs, angular, version 7 if it matters) as the front end. To handle this (since it truly is a separate app that is ...
0
votes
0answers
72 views

Cross-Site Scripting in visual force input

We have received a security warning regarding Cross-Site Scripting for below input : <apex:inputtext value="{!mergeText}" id="txtField" disabled="true" size="25"/> What changes are required to ...
0
votes
1answer
151 views

Managed package and security review

We have developed a solution that we want to distribute as ISV on AppExchange. What happens if we have people install those packages while they are in review? Do customers need to reinstall our ...
7
votes
3answers
2k views

Do we need to check CRUD permissions on custom metadata type/custom setting to pass the AppExchange security review

I have an application that we need to upload on AppExchnage but we need to pass the security review so I have a query on the custom metadata type so do we need to check the isAccessible() permission ...
2
votes
1answer
61 views

Do we have to force all FFLIB classes with `with sharing` keywords to pass security review?

I'm using FFLIB classes in my managed package and i just wanted to know if i should mark FFLIB classes use in my package with with sharing keyword to follow security review requirements ? Thanks,
2
votes
2answers
122 views

Connected App consumerKey Security Review issue

We have two connected apps that are part of a managed package that is up for review. One app is used for API access to Salesforce from an external web platform, and the other is used as a CanvasApp ...
-1
votes
1answer
146 views

CRUD/FLS checks on Dynamic SOQL - Needed for WHERE clause? [duplicate]

For the AppExchange Security Review, do we need to check FLS on a Dynamic SOQL WHERE clause as well? Ex: If Contact.My_Custom_Field__c is not visible to the logged in user, then the following SOQL ...
3
votes
1answer
151 views

Do I need to define sharing for test classes?

The question is simple: should test classes be defined with sharing with sharing | without sharing | inherited sharing to pass the security review? Technically Salesforce enforces this by saying it ...
3
votes
2answers
215 views

Do I need to define sharing for inner classes?

In preparation to Security Review I am checking that all my classes follow instructions from Sharing in Apex Classes. Now I am wondering do inner classes also need to be defined as with sharing | ...
11
votes
4answers
1k views

How to best enforce CRUD/FLS and pass Security Review

Since Salesforce began to require CRUD / FLS checks as part of the Security Review for AppEchange apps in 2015 there has been a lot of discussions why this cannot be done by the platform and how this ...
5
votes
1answer
194 views

Is Jest mandatory in LWC For appExchange app

As SF stated Jest is independent of Salesforce and doesn't run in web browser. Is it mandatory to write coverage/unit testing for Lightning Web Components and add in bundle while creating manage ...
5
votes
0answers
101 views

Auth. Providers and Named Credentilas for Salesforce Security Review

We have managed package, where in we are asking users to configure Auth. Providers,Named Credentials after package installation as user might need to change endpoint when user have to connect to ...
5
votes
3answers
431 views

Second-Generation Managed Package Security Review

Generally, the question stands as what steps need to be done in order to send 2-nd generation managed package for security review. Current conditions: I have developed 2-nd generation managed ...
3
votes
0answers
152 views

Integrate external app using IFrame (not Canvas) and Security review

I have a customer that wants to integrate an external Java App with a Managed Package. As the endpoint (domain name) of the external Java App(s) is not static but differs from customer to customer we ...

1
2 3 4 5 6