Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
0 votes
0 answers
35 views

Does using Function (an Alternative to eval function in js) will impact Salesforce AppExchange Security Review

In our Second Generation Managed Package, we are using Function() as an alternative to Eval Function as mentioned in this link to evaluate an expression in Aura Component. Does it have any impact in ...
S1th's user avatar
  • 69
0 votes
2 answers
77 views

Does Loading Static Resource Dynamically through URL pass the Salesforce AppExchange Security Review

We have created a Second Generation Managed Package and in it we need to load the static resource which is uploaded by the Subscriber (the one who installs the package). We have loaded the static ...
S1th's user avatar
  • 69
0 votes
1 answer
80 views

How to Fix Security Violation AvoidGlobalModifier in a Promoted 2GP Managed Package for the Security Review

I did wrong and I promoted a non-security-review-ready version in a managed package. I have a global identifier and if I try to create a new version without the it, it triggers a Global/WebService ...
Искрен Станиславов's user avatar
0 votes
1 answer
53 views

Do I need to check FLS for each field when creating a new object record in apex?

If I am creating a new Contact record in apex, will the following code be sufficient for FLS/CRUD requirements in a security review, or will I need to check .isCreateable() for each field individually ...
lhh13's user avatar
  • 41
2 votes
2 answers
162 views

Insecure Storage of Sensitive Data Vulnerability for a security review

We have received this issue in our security review "Insecure Storage of Sensitive Data Vulnerability ". I am making a call to external service to get a encrypted claim that i am using to ...
Manjot Singh's user avatar
  • 3,406
1 vote
1 answer
182 views

LWC: Click-jacking due to CSS Vulnerability

we received an issue in our salesforce security report "LWC: Click-jacking due to CSS Vulnerability". It list out CSS files where this issue is reported but no more info is provided for this....
Manjot Singh's user avatar
  • 3,406
1 vote
1 answer
101 views

Do I need to enforce security rules for SOQL in test methods?

I'm currently in the process of updating a managed package for security review. I've been adding the "WITH SECURITY_ENFORCED" statement to SOQL requests, however I've struggled to find any ...
lhh13's user avatar
  • 41
0 votes
1 answer
90 views

Upgrading a Second Generation Managed Package to next version

We have created a Second Generation Managed Package and published it in AppExchange and we need to release the next version with few changes in existing codes. These are the things which we don't ...
S1th's user avatar
  • 69
6 votes
2 answers
362 views

Zap scan commercial APIs used in AppExchange apps?

My Managed package, which will soon be submitted for Security Review to be listed on the AppExchange, uses two commercial REST APIs (one of them is the Open AI API for GPT4). As someone who submitted ...
Robert Sösemann's user avatar
1 vote
1 answer
86 views

JS in Salesforce DOM security review failure

I have just been sent back the security review report for our ISV partner app and one of the errors is 'JS in Salesforce DOM'. The file they have referenced is a .weblink file, the code snippet they'...
lhh13's user avatar
  • 41
1 vote
0 answers
65 views

Salesforce managed package security review

We had submitted our managed package for security review and it had failed multiple times. In the latest failure report , below vulnerability is reported which does not have any public documentation. (...
Rohit's user avatar
  • 1,614
0 votes
1 answer
46 views

Would Changing the Installation key of the Second Generation Managed Package needs once again approval from Salesforce

We have published our Second Generation Managed Package in AppExchange Portal after approval from Salesforce. But we want to update the installation key of the Package. Would it needs approval once ...
S1th's user avatar
  • 69
1 vote
1 answer
299 views

AppExchange Security Review Requiring Fee Submission for FREE Listing Solution

Hope you are having a great day. We have developed an AppExchange solution to be listed. The solution's pricing model is set to free and the listing is submitted for approval. I have completed ...
Asadullah Shaikh's user avatar
0 votes
1 answer
95 views

Security Scanner finds XSS, JSENCODE incompatible with Radio field expecting Boolean value

ISSUE: XSS issue in the following code, value fields will not expect JSENCODE as it expects a Boolean. I have tried following options OPTIONS: value= Boolean('{!JSENCODE(IF(ques.Question__c,"true&...
Deeksha Gaur's user avatar
2 votes
1 answer
168 views

Lightning Message Channel deletion from 2GP or isExpose change to false

we failed security review of second-generation managed package because Lightning Message Channel (LMC) has isExposed=true. It should be false. The value of isExposed is not possible to change to false,...
rstrader's user avatar
3 votes
1 answer
166 views

Is the User Mode approach to object and field security acceptable in a security review?

This Enforce User Mode for Database Operations looks by far the cleanest approach to implement the object and field-level security that is required to pass a Salesforce AppExchange Security Review. (...
Keith C's user avatar
  • 135k
2 votes
0 answers
74 views

What differs between Checkmarx in Partner or Customer Security Portal?

I want to submit a package for security review, and Checkmarx in the Partner Security Portal has been unavailable for some time. At this point, I can either keep trying to resolve why it doesn't work ...
Manuel Moya's user avatar
0 votes
2 answers
122 views

New Partner Console: Update Sec Review documents for new version

I recently published a brand new Managed Package to the AppExchange. I passed Security Review as well. Now a few weeks later, I made some enhancements to my app, which also changed the documents that ...
Robert Sösemann's user avatar
0 votes
1 answer
28 views

Is request invocation from frontend javascript is secure and safe? What is the limit for file size when uploading files using Visualforce Javascript?

On one legacy project the following pattern was implemented. Visualforce page has div element with ondrop event handler which processes event.dataTransfer.files attribute to initiate FileReader with ...
Patlatus's user avatar
  • 16k
6 votes
3 answers
872 views

With USER_MODE - do we still need SOQL and DML libs?

As the Security model of Apex was leaky in the past, everybody who took - or as AppExchange Partners had to take - Security seriously was building or using libraries to enforce CRUD/FLS rules. The ...
Robert Sösemann's user avatar
3 votes
1 answer
156 views

Security Review Test Environment - how many users for Salesforce?

Until today I believed that you need to provide at least TWO users to Salesforce to test your app in the Test Environment you submit for Security Review. I tried to find that rule in an official ...
Robert Sösemann's user avatar
0 votes
1 answer
131 views

When is the External Service Scan required in Salesforce Security Review?

I am currently working with a Salesforce integration in which a third-party system creates/updates records in the Salesforce org using the native REST API of Salesforce. It is a unidirectional ...
Manuel Moya's user avatar
0 votes
1 answer
56 views

Self certify that the package is lightning ready

How do I certify that my package is Lightning ready? Is that something that we have to raise the case with the community? In the checklist, it shows that I have to "Self-certify listing as ...
Rahul Allada's user avatar
1 vote
1 answer
98 views

Salesforce package version creation after resolving the errors

We are planning to publish the package to the appexchange security review process before which we have run through a security scan. The package version is 0.1.0-1. After resolving the errors from the ...
Rahul Allada's user avatar
1 vote
0 answers
59 views

Checkmarx reporting wrong function name?

I just ran a Checkmarx scan today. It reported the following Apex Serious Security Risk: You can see the report is making a reference to isCreatable(). However, the name of the method in my Apex code ...
dev4life's user avatar
  • 372
0 votes
0 answers
44 views

'Select Listing Name to Scan' is empty in the Partner Security Portal

As mentioned by @phil in Sending review to the checkmarx where multiple developments are included I have gone to partner security portal. Though the packages are being displayed in the partner ...
Rahul Allada's user avatar
1 vote
1 answer
149 views

Sending review to the checkmarx where multiple developments are included

I have a org that is connected to the partner community. In this org, there are managed packages, unmanaged packages, and various other developments that includes code that is not required for the ...
Rahul Allada's user avatar
0 votes
1 answer
82 views

How to scan the Second Generation managed package code on Checkmarx Scanner from Partner Security Portal

I have created a second generation managed package using the dev hub org and namespace org and I have connected the dev hub org in the organizations subtab in publishing tab. But when I tried to login ...
S1th's user avatar
  • 69
1 vote
0 answers
119 views

What does the Dereferenced Field vulnerability in Security Review scan means?

I've received a vulnerability from Checkmarx scan that is labelled as Dereferenced Field vulnerability. The scan report message reads like this: A possible dereference exist in method uploadDocument. ...
VarunC's user avatar
  • 5,900
3 votes
0 answers
248 views

Why & How to use Burp Suite for Salesforce External Services

I am investigating the possibility of using Burp as an alternative to Chimera or OWASP Zap to provide a scan report of an External Service in the Salesforce Security Review. The information that I am ...
Manuel Moya's user avatar
0 votes
1 answer
94 views

Managed Package Yearly Security Review

I was under the assumption that after 1 year a managed package should again go thru security review. However I published a free app that passed the security review at 26-1-2022. Since then I published ...
Liron C's user avatar
  • 1,764
0 votes
2 answers
57 views

Using SOQL Injection to delete data

I know that SOQL injection can be used to query data the user shouldn't see by providing a value like Bob \' OR Name LIKE '%'. But I'm wondering if you could use an input value like Name LIKE '%')'; ...
Tom's user avatar
  • 153
1 vote
0 answers
325 views

Transport False-Positive comments to Checkmarx report

I want to find the best way to address false positives in the Checkmarx report. One of the points I am investigating is how to make the Checkmarx report to display the false positive comment that has ...
Manuel Moya's user avatar
0 votes
0 answers
161 views

Client DOM Code Injection in Lightning Aura Component

The security scanner alert us about client DOM code injection on this lines: L 3: var orgin = window.location.origin; L 4: component.set("v.orgin",orgin); L 5: window.addEventListener("...
harshi's user avatar
  • 1
8 votes
0 answers
299 views

Fail Security Review again and again. New process?

I am aware that Salesforce recently changed some rules for Security Review, which makes the life of ISV and PDO partners harder. Here is another one that I am seeing, and ask for some guidance. In the ...
Robert Sösemann's user avatar
39 votes
6 answers
3k views

Call Salesforce API from Apex and not fail Security Review

For years I have used Salesforce APIs from within Apex. Mostly to enhance my apps with Setup automation. So I used the Tooling and Metadata API from code snippets that used UserInfo.getSessionId() and ...
Robert Sösemann's user avatar
-1 votes
1 answer
434 views

What happens when Password setting is updated?

I am trying to improve our Salesforce Org Health Check score. I have one setting "Password complexity requirement" where current value is "Must include alpha and numeric characters"...
SFDCDJ's user avatar
  • 1,814
0 votes
1 answer
182 views

How to set isExposed of messagechannel component of released package but not yet approved from security review?

My app has gone through security review for the first time and they failed it stating that the messaging channel component has isExposed to true and that it should be set to false. Now when I try to ...
Birey's user avatar
  • 121
1 vote
1 answer
83 views

If you break ancestry, would you have to start security process from scratch?

If you break ancestry, would you have to start security process from scratch? I know that if you want to create a package from a different dev hub, you would have to restart the security review ...
Patlatus's user avatar
  • 16k
1 vote
2 answers
68 views

What type of product am I submitting for security review?

I am about to submit my Salesforce package (2GP) for security review, and clicking "Start Review" in the Partner Community portal prompts me with a choice: What type of product are you ...
Calvin Fisher's user avatar
0 votes
1 answer
127 views

How to resolve SOQL SOSL Injection security error

I am fairly new to salesforce. I am getting the soql sosl injection error in the below method while doing query. How to resolve this error? public static Days_Unavailable__c getAvlRecordById(String ...
goel123's user avatar
  • 15
0 votes
1 answer
297 views

How do I submit a 2nd generation managed package for security review?

I am trying to get 2nd generation managed package ready for security review. It is not showing up in the devhub org. How do I submit the package. Do I zip up the source code and submit it? I have ...
Birey's user avatar
  • 121
0 votes
0 answers
39 views

Should I release / promote managed 2nd generation before security review or after security review?

Should I release / promote managed 2nd generation before security review or after security review? I am ready for security review but I am confused if I should use the beta versions that I have been ...
Birey's user avatar
  • 121
1 vote
0 answers
134 views

Access to Security Portal (Scanner) when building 2GP

I work as a PDO partner for a customer who wants to have an app on App Exchange. We develop a 2GP package, where Dev Hub is located in the customer PBO, which is linked as an organization to App ...
Anna Walach's user avatar
0 votes
1 answer
118 views

Is fixing "Apex Code Quality" issues necessary for passing security review?

I have fixed all the "Apex Critical Security Risk" issues but there are few apex code quality issues remaining. Some of them are false positives and some are correct. But due to time ...
Manjot Singh's user avatar
  • 3,406
1 vote
1 answer
157 views

Security Review: Cloud Service uses and stores OAuth tokens

My customer runs a Cloud Service for many years, that connects with Salesforce orgs via OAuth flow and stores org tokens in its database. As this service wasn't on the AppExchange my customer did not ...
Robert Sösemann's user avatar
-1 votes
1 answer
37 views

Which Salesforce scanner tool can I use to scan Chrome Extension(built on Angular utilizing Salesforce APIs)?

We have a Chrome Extension built upon Angular utilizing Salesforce APIs, now We want to publish it on APP Exchange, so we have to upload a scanner report, which scanner tool can we use? I tried using ...
Sagar Alwani's user avatar
3 votes
1 answer
320 views

Resubmit for Security Review without Patches

I am working for an existing AppExchange ISV Partner that missed the deadlines for Security Review resubmission. When that happens Salesforce is not only taking your Listing down but also deactivating ...
Robert Sösemann's user avatar
6 votes
1 answer
303 views

Best (commercial) Scanner to stay prepared for Security Review

For ISVs to be safe to (re)submit their app for Security Review without issues Checkmarx still is the only authoritative tool. But it is also cumbersome and limited as: Community Scanner is limited ...
Robert Sösemann's user avatar
1 vote
0 answers
217 views

Run Checkmarx on code not in packaging org (too big for Community scanner)

I am consulting an ISV partner with their resubmission of the Salesforce Security Review. They ran the initial Checkmarx scan using the Partner Scanner on the code in their Packaging org, then fixed ...
Robert Sösemann's user avatar

1
2 3 4 5
8