Questions tagged [security-review]
All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.
352
questions
0
votes
0
answers
35
views
Does using Function (an Alternative to eval function in js) will impact Salesforce AppExchange Security Review
In our Second Generation Managed Package, we are using Function() as an alternative to Eval Function as mentioned in this link to evaluate an expression in Aura Component. Does it have any impact in ...
- 69
0
votes
2
answers
77
views
Does Loading Static Resource Dynamically through URL pass the Salesforce AppExchange Security Review
We have created a Second Generation Managed Package and in it we need to load the static resource which is uploaded by the Subscriber (the one who installs the package).
We have loaded the static ...
- 69
0
votes
1
answer
80
views
How to Fix Security Violation AvoidGlobalModifier in a Promoted 2GP Managed Package for the Security Review
I did wrong and I promoted a non-security-review-ready version in a managed package.
I have a global identifier and if I try to create a new version without the it, it triggers a Global/WebService ...
0
votes
1
answer
53
views
Do I need to check FLS for each field when creating a new object record in apex?
If I am creating a new Contact record in apex, will the following code be sufficient for FLS/CRUD requirements in a security review, or will I need to check .isCreateable() for each field individually ...
- 41
2
votes
2
answers
162
views
Insecure Storage of Sensitive Data Vulnerability for a security review
We have received this issue in our security review "Insecure Storage of Sensitive Data Vulnerability ".
I am making a call to external service to get a encrypted claim that i am using to ...
- 3,406
1
vote
1
answer
182
views
LWC: Click-jacking due to CSS Vulnerability
we received an issue in our salesforce security report "LWC: Click-jacking due to CSS Vulnerability". It list out CSS files where this issue is reported but no more info is provided for this....
- 3,406
1
vote
1
answer
101
views
Do I need to enforce security rules for SOQL in test methods?
I'm currently in the process of updating a managed package for security review. I've been adding the "WITH SECURITY_ENFORCED" statement to SOQL requests, however I've struggled to find any ...
- 41
0
votes
1
answer
90
views
Upgrading a Second Generation Managed Package to next version
We have created a Second Generation Managed Package and published it in AppExchange and we need to release the next version with few changes in existing codes. These are the things which we don't ...
- 69
6
votes
2
answers
362
views
Zap scan commercial APIs used in AppExchange apps?
My Managed package, which will soon be submitted for Security Review to be listed on the AppExchange, uses two commercial REST APIs (one of them is the Open AI API for GPT4).
As someone who submitted ...
- 37.3k
1
vote
1
answer
86
views
JS in Salesforce DOM security review failure
I have just been sent back the security review report for our ISV partner app and one of the errors is 'JS in Salesforce DOM'. The file they have referenced is a .weblink file, the code snippet they'...
- 41
1
vote
0
answers
65
views
Salesforce managed package security review
We had submitted our managed package for security review and it had failed multiple times.
In the latest failure report , below vulnerability is reported which does not have any public documentation. (...
- 1,614
0
votes
1
answer
46
views
Would Changing the Installation key of the Second Generation Managed Package needs once again approval from Salesforce
We have published our Second Generation Managed Package in AppExchange Portal after approval from Salesforce. But we want to update the installation key of the Package. Would it needs approval once ...
- 69
1
vote
1
answer
299
views
AppExchange Security Review Requiring Fee Submission for FREE Listing Solution
Hope you are having a great day.
We have developed an AppExchange solution to be listed. The solution's pricing model is set to free and the listing is submitted for approval. I have completed ...
0
votes
1
answer
95
views
Security Scanner finds XSS, JSENCODE incompatible with Radio field expecting Boolean value
ISSUE: XSS issue in the following code, value fields will not expect JSENCODE as it expects a Boolean.
I have tried following options
OPTIONS:
value= Boolean('{!JSENCODE(IF(ques.Question__c,"true&...
2
votes
1
answer
168
views
Lightning Message Channel deletion from 2GP or isExpose change to false
we failed security review of second-generation managed package because Lightning Message Channel (LMC) has isExposed=true. It should be false. The value of isExposed is not possible to change to false,...
- 69
3
votes
1
answer
166
views
Is the User Mode approach to object and field security acceptable in a security review?
This Enforce User Mode for Database Operations looks by far the cleanest approach to implement the object and field-level security that is required to pass a Salesforce AppExchange Security Review.
(...
- 135k
2
votes
0
answers
74
views
What differs between Checkmarx in Partner or Customer Security Portal?
I want to submit a package for security review, and Checkmarx in the Partner Security Portal has been unavailable for some time.
At this point, I can either keep trying to resolve why it doesn't work ...
- 685
0
votes
2
answers
122
views
New Partner Console: Update Sec Review documents for new version
I recently published a brand new Managed Package to the AppExchange. I passed Security Review as well. Now a few weeks later, I made some enhancements to my app, which also changed the documents that ...
- 37.3k
0
votes
1
answer
28
views
Is request invocation from frontend javascript is secure and safe? What is the limit for file size when uploading files using Visualforce Javascript?
On one legacy project the following pattern was implemented.
Visualforce page has div element with ondrop event handler which processes event.dataTransfer.files attribute to initiate FileReader with ...
- 16k
6
votes
3
answers
872
views
With USER_MODE - do we still need SOQL and DML libs?
As the Security model of Apex was leaky in the past, everybody who took - or as AppExchange Partners had to take - Security seriously was building or using libraries to enforce CRUD/FLS rules. The ...
- 37.3k
3
votes
1
answer
156
views
Security Review Test Environment - how many users for Salesforce?
Until today I believed that you need to provide at least TWO users to Salesforce to test your app in the Test Environment you submit for Security Review.
I tried to find that rule in an official ...
- 37.3k
0
votes
1
answer
131
views
When is the External Service Scan required in Salesforce Security Review?
I am currently working with a Salesforce integration in which a third-party system creates/updates records in the Salesforce org using the native REST API of Salesforce. It is a unidirectional ...
- 685
0
votes
1
answer
56
views
Self certify that the package is lightning ready
How do I certify that my package is Lightning ready? Is that something that we have to raise the case with the community?
In the checklist, it shows that I have to "Self-certify listing as ...
- 429
1
vote
1
answer
98
views
Salesforce package version creation after resolving the errors
We are planning to publish the package to the appexchange security review process before which we have run through a security scan. The package version is 0.1.0-1. After resolving the errors from the ...
- 429
1
vote
0
answers
59
views
Checkmarx reporting wrong function name?
I just ran a Checkmarx scan today. It reported the following Apex Serious Security Risk:
You can see the report is making a reference to isCreatable(). However, the name of the method in my Apex code ...
- 372
0
votes
0
answers
44
views
'Select Listing Name to Scan' is empty in the Partner Security Portal
As mentioned by @phil in Sending review to the checkmarx where multiple developments are included I have gone to partner security portal.
Though the packages are being displayed in the partner ...
- 429
1
vote
1
answer
149
views
Sending review to the checkmarx where multiple developments are included
I have a org that is connected to the partner community. In this org, there are managed packages, unmanaged packages, and various other developments that includes code that is not required for the ...
- 429
0
votes
1
answer
82
views
How to scan the Second Generation managed package code on Checkmarx Scanner from Partner Security Portal
I have created a second generation managed package using the dev hub org and namespace org and I have connected the dev hub org in the organizations subtab in publishing tab. But when I tried to login ...
- 69
1
vote
0
answers
119
views
What does the Dereferenced Field vulnerability in Security Review scan means?
I've received a vulnerability from Checkmarx scan that is labelled as Dereferenced Field vulnerability.
The scan report message reads like this:
A possible dereference exist in method uploadDocument. ...
- 5,900
3
votes
0
answers
248
views
Why & How to use Burp Suite for Salesforce External Services
I am investigating the possibility of using Burp as an alternative to Chimera or OWASP Zap to provide a scan report of an External Service in the Salesforce Security Review.
The information that I am ...
- 685
0
votes
1
answer
94
views
Managed Package Yearly Security Review
I was under the assumption that after 1 year a managed package should again go thru security review.
However I published a free app that passed the security review at 26-1-2022. Since then I published ...
- 1,764
0
votes
2
answers
57
views
Using SOQL Injection to delete data
I know that SOQL injection can be used to query data the user shouldn't see by providing a value like Bob \' OR Name LIKE '%'. But I'm wondering if you could use an input value like Name LIKE '%')'; ...
- 153
1
vote
0
answers
325
views
Transport False-Positive comments to Checkmarx report
I want to find the best way to address false positives in the Checkmarx report. One of the points I am investigating is how to make the Checkmarx report to display the false positive comment that has ...
- 685
0
votes
0
answers
161
views
Client DOM Code Injection in Lightning Aura Component
The security scanner alert us about client DOM code injection on this lines:
L 3: var orgin = window.location.origin;
L 4: component.set("v.orgin",orgin);
L 5: window.addEventListener("...
- 1
8
votes
0
answers
299
views
Fail Security Review again and again. New process?
I am aware that Salesforce recently changed some rules for Security Review, which makes the life of ISV and PDO partners harder. Here is another one that I am seeing, and ask for some guidance.
In the ...
- 37.3k
39
votes
6
answers
3k
views
Call Salesforce API from Apex and not fail Security Review
For years I have used Salesforce APIs from within Apex. Mostly to enhance my apps with Setup automation. So I used the Tooling and Metadata API from code snippets that used UserInfo.getSessionId() and ...
- 37.3k
-1
votes
1
answer
434
views
What happens when Password setting is updated?
I am trying to improve our Salesforce Org Health Check score.
I have one setting "Password complexity requirement" where current value is "Must include alpha and numeric characters"...
- 1,814
0
votes
1
answer
182
views
How to set isExposed of messagechannel component of released package but not yet approved from security review?
My app has gone through security review for the first time and they failed it stating that the messaging channel component has isExposed to true and that it should be set to false.
Now when I try to ...
- 121
1
vote
1
answer
83
views
If you break ancestry, would you have to start security process from scratch?
If you break ancestry, would you have to start security process from scratch?
I know that if you want to create a package from a different dev hub, you would have to restart the security review ...
- 16k
1
vote
2
answers
68
views
What type of product am I submitting for security review?
I am about to submit my Salesforce package (2GP) for security review, and clicking "Start Review" in the Partner Community portal prompts me with a choice:
What type of product are you ...
- 121
0
votes
1
answer
127
views
How to resolve SOQL SOSL Injection security error
I am fairly new to salesforce. I am getting the soql sosl injection error in the below method while doing query. How to resolve this error?
public static Days_Unavailable__c getAvlRecordById(String ...
- 15
0
votes
1
answer
297
views
How do I submit a 2nd generation managed package for security review?
I am trying to get 2nd generation managed package ready for security review. It is not showing up in the devhub org. How do I submit the package. Do I zip up the source code and submit it?
I have ...
- 121
0
votes
0
answers
39
views
Should I release / promote managed 2nd generation before security review or after security review?
Should I release / promote managed 2nd generation before security review or after security review? I am ready for security review but I am confused if I should use the beta versions that I have been ...
- 121
1
vote
0
answers
134
views
Access to Security Portal (Scanner) when building 2GP
I work as a PDO partner for a customer who wants to have an app on App Exchange. We develop a 2GP package, where Dev Hub is located in the customer PBO, which is linked as an organization to App ...
- 81
0
votes
1
answer
118
views
Is fixing "Apex Code Quality" issues necessary for passing security review?
I have fixed all the "Apex Critical Security Risk" issues but there are few apex code quality issues remaining. Some of them are false positives and some are correct. But due to time ...
- 3,406
1
vote
1
answer
157
views
Security Review: Cloud Service uses and stores OAuth tokens
My customer runs a Cloud Service for many years, that connects with Salesforce orgs via OAuth flow and stores org tokens in its database.
As this service wasn't on the AppExchange my customer did not ...
- 37.3k
-1
votes
1
answer
37
views
Which Salesforce scanner tool can I use to scan Chrome Extension(built on Angular utilizing Salesforce APIs)?
We have a Chrome Extension built upon Angular utilizing Salesforce APIs, now We want to publish it on APP Exchange, so we have to upload a scanner report, which scanner tool can we use?
I tried using ...
3
votes
1
answer
320
views
Resubmit for Security Review without Patches
I am working for an existing AppExchange ISV Partner that missed the deadlines for Security Review resubmission. When that happens Salesforce is not only taking your Listing down but also deactivating ...
- 37.3k
6
votes
1
answer
303
views
Best (commercial) Scanner to stay prepared for Security Review
For ISVs to be safe to (re)submit their app for Security Review without issues Checkmarx still is the only authoritative tool. But it is also cumbersome and limited as:
Community Scanner is limited ...
- 37.3k
1
vote
0
answers
217
views
Run Checkmarx on code not in packaging org (too big for Community scanner)
I am consulting an ISV partner with their resubmission of the Salesforce Security Review.
They ran the initial Checkmarx scan using the Partner Scanner on the code in their Packaging org, then fixed ...
- 37.3k