Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
0 votes
1 answer
36 views

How to resolve SOQL SOSL Injection security error

I am fairly new to salesforce. I am getting the soql sosl injection error in the below method while doing query. How to resolve this error? public static Days_Unavailable__c getAvlRecordById(String ...
  • 13
0 votes
1 answer
36 views

How do I submit a 2nd generation managed package for security review?

I am trying to get 2nd generation managed package ready for security review. It is not showing up in the devhub org. How do I submit the package. Do I zip up the source code and submit it? I have ...
  • 121
0 votes
0 answers
22 views

Should I release / promote managed 2nd generation before security review or after security review?

Should I release / promote managed 2nd generation before security review or after security review? I am ready for security review but I am confused if I should use the beta versions that I have been ...
  • 121
1 vote
0 answers
27 views

Access to Security Portal (Scanner) when building 2GP

I work as a PDO partner for a customer who wants to have an app on App Exchange. We develop a 2GP package, where Dev Hub is located in the customer PBO, which is linked as an organization to App ...
0 votes
1 answer
30 views

Is fixing "Apex Code Quality" issues necessary for passing security review?

I have fixed all the "Apex Critical Security Risk" issues but there are few apex code quality issues remaining. Some of them are false positives and some are correct. But due to time ...
  • 3,315
1 vote
1 answer
110 views

Security Review: Cloud Service uses and stores OAuth tokens

My customer runs a Cloud Service for many years, that connects with Salesforce orgs via OAuth flow and stores org tokens in its database. As this service wasn't on the AppExchange my customer did not ...
-1 votes
1 answer
18 views

Which Salesforce scanner tool can I use to scan Chrome Extension(built on Angular utilizing Salesforce APIs)?

We have a Chrome Extension built upon Angular utilizing Salesforce APIs, now We want to publish it on APP Exchange, so we have to upload a scanner report, which scanner tool can we use? I tried using ...
3 votes
1 answer
192 views

Resubmit for Security Review without Patches

I am working for an existing AppExchange ISV Partner that missed the deadlines for Security Review resubmission. When that happens Salesforce is not only taking your Listing down but also deactivating ...
6 votes
1 answer
119 views

Best (commercial) Scanner to stay prepared for Security Review

For ISVs to be safe to (re)submit their app for Security Review without issues Checkmarx still is the only authoritative tool. But it is also cumbersome and limited as: Community Scanner is limited ...
1 vote
0 answers
77 views

Run Checkmarx on code not in packaging org (too big for Community scanner)

I am consulting an ISV partner with their resubmission of the Salesforce Security Review. They ran the initial Checkmarx scan using the Partner Scanner on the code in their Packaging org, then fixed ...
0 votes
0 answers
19 views

Unable to begin Security Review

I have a lightning App which I have scanned using the Checkmarx app, along with a scan with ZAP. However, when I go to the security review tab, the Start Review button is greyed out and the Update ...
5 votes
4 answers
716 views

How different is Initial Security Review from Resubmission

An ISV customer of mine has a Managed Package in the AppExchange for many years now. He recently was asked to resubmit for Security Review and is now wondering what to expect and how to best plan and ...
0 votes
1 answer
23 views

SOAP Web API scan for underlying API undder my salesforce app

we are using the web API (SOAP) as a backend in our salesforce app. Do I need to attach the ZAP/Burp or Chimera report with my submit material ? or these reports are only required for WebAppliaction . ...
0 votes
1 answer
27 views

security review payment needed every time a different package is submitted?

does every time I submit a package for review the review fee has to be paid? Or is it just once per year?
  • 218
2 votes
0 answers
19 views

How to avoid using position:absolute in stylesheets for aura components due to security concerns as mentioned in the ISV guide

I'm trying to pass security review for my managed package. I have to a security issue to address: Unsafe CSS position declaration: position: absolute; The Salesforce Platform tries to ensure that ...
2 votes
0 answers
47 views

Possibility to Install a managed package on production while package is under Security Review

We are working on a managed package, which we are planning to submit for security review in a few weeks. While the package will be in the security review, we would also like to install the managed ...
  • 2,250
0 votes
1 answer
63 views

VfUnescapeEl PMD fix for salesforce static resource page

We are getting VfUnescapeEl error in our sfdx report on the following line : <a href="{!LEFT($CurrentPage.URL,FIND('/',$CurrentPage.URL,9))}{{x.Id}}">...</a> here, x.id will be ...
  • 1
0 votes
1 answer
104 views

Necessity to resolve all PMD issues for security review

We generated a pmd report using sfdx, is it necessary to resolve all the sfdx report issues to pass the salesforce security review or those are just warnings and can be ignored to pass the security ...
0 votes
1 answer
32 views

Does Upgrading Major Version Number Trigger Security Review

We're rolling out a larger change in our manage package and it would be nice to recognise these changes by increasing the Major version number on our package. The concern is whether it will trigger a ...
0 votes
1 answer
169 views

Why newly released package version is not available in Partner Security Portal scanner?

We have released a new minor 2GMP release version and try to check it for Security and Quality rules in Partner Security Portal scanner, but the new version doesn't show up in the picklist for Select ...
  • 13.9k
1 vote
1 answer
70 views

Pass SF security review and keep <apex:pageMessages escape="false"/> in a visualforce page

to pass security review we must avoid <apex:pageMessages escape="false"/> But without the escape="false", my message will not be clickable anymore. So inside my controller, I ...
  • 11
0 votes
0 answers
61 views

How to Scan External callouts( APIs ) in OWASAP ZAP

In my environment, I have used a couple of external APIs I need to scan in OWASAP ZAP OWSAP ZAP for security review. it is possible another way to Scan Callouts Api and generate reports? I have ho ...
2 votes
1 answer
59 views

Risks & Benefits of Installing Someone Else's Unlocked 2nd Gen Package

I'm interested in introducing a GitHub project into our enterprise org. That GitHub project currently offers the tool in both Managed Package and Unlocked Package format. The Unlocked Package format ...
0 votes
1 answer
44 views

Is it a liability to use the lightning container npm package? (not been updated for 4 years...)

I have embedded my react app in a lightning container iframe as the docs suggest. <aura:component access="global" implements="flexipage:availableForAllPageTypes"> <...
  • 1
1 vote
1 answer
569 views

URL Redirect Attack - Apex

I have been trying to fix the below URL Redirection Attack code block but couldn't find a working solution: String url = '/' + oGenericObj.getDescribe().getKeyPrefix() + '/e'; ...
-3 votes
1 answer
185 views

Security Scanner Report in Owasp zap

How to scan my salesforce app in Owasap zap, need to cover everything such as custom objects, flow, process builder, reports and dashboard, etc. at the end need to generate a report, is possible?
2 votes
0 answers
101 views

Information Disclosure Vulnerability

Here is a security vulnerability issue of "Information Disclosure" reported by the Salesforce Team. URL https://yourdomain.lightning.force.com/aura?r=13&aura.DynamicComponent....
  • 397
1 vote
1 answer
93 views

Is there any way to set feature parameters for beta versions which did not pass security review?

Is there any way set feature parameters for package beta versions which did not pass security review? Assuming you are going to release a new version of package which will include feature parameters. ...
  • 13.9k
4 votes
0 answers
57 views

AppExchange Apps - Security Concerns on embedding URLs with Encrypted Short Lived Access Tokens

We are working on an AppExchange App which integrates with external application at the UI Layer. External application (composite app) has different widgets which we can embed within AppExchange Aura ...
  • 2,250
0 votes
1 answer
62 views

Will the use of apex:actionFunction result in a CSRF vulnerability?

I need the record to be updated when the visualforce page loads. In the apex:page tag, I utilised the action property to invoke the apex method that executes update DML. Salesforce considers an onload ...
  • 1
1 vote
1 answer
112 views

How can I change custom settings field visibility which contains sensitive data to private or protected?

In the process of getting a managed package reviewed and it has been flagged for Insecure Storage of Sensitive Data and highlight the following xml. <?xml version="1.0" encoding="UTF-...
3 votes
1 answer
165 views

Security Review: Lightning: CSS Outside Component

In our SF Security Re-Review report a lightning component was flagged for "Lightning: CSS Outside Component". The lines they referenced were: ... <button style="font-size: 20px;top: ...
  • 1,387
1 vote
1 answer
1k views

GET Request with Client ID and Client Secret as Parameter

We are working on an AppExchange app which integrates with 3rd Party application. To connect external app with Salesforce, a Subscriber System admin needs to connect External System using Client Id/...
  • 2,239
1 vote
1 answer
124 views

Checkmarx - Bulkify Apex Methods Using Collections In Methods

Recently I ran a checkmarx scan and saw this issue Query: Bulkify Apex Methods Using Collections In Methods I don't understand why checkmarx is showing this issue in few places and not in all methods....
  • 193
3 votes
0 answers
97 views

Publishing platform event in doInit of Aura or page load action cause any security vulnerability? [closed]

We have a scenario to publish platform event in doInit of Aura Component (or) action of visualforce page, where in the platform event trigger we're making a dml. As far as we researched and debugged, ...
1 vote
0 answers
187 views

FLS and CRUD Check for Platform event and Meta Data DML

This might be a silly question, but don't want to get caught under security review. I have three questions/confirmations related to the security review FLS/CRUD Check Needed while publishing platform ...
3 votes
1 answer
169 views

Using Window.SessionStorage in product development cause any security vulnerability?

We're storing some encrypted text in the session Window.sessionStorage for community portal, just to avoid multiple server call backs for different navigations. Will it be flagged under any security ...
2 votes
2 answers
372 views

SessionID access vulnerability found when using Metadata API

Salesforce is performing manual security review in our package. They have found SessionID access Vulnerability in one of our file where we are using Metadata API to grant permissions on profile and ...
  • 5,734
0 votes
1 answer
324 views

Passing Client Id and Client Secret in URL as Encrypted String for AppExchange App

We are developing an AppExchange application which integrates with external application .Every customer has a connected app because of different branding and different and different callback URLs. ...
3 votes
0 answers
114 views

lightning:container performance/security and why no alternative in LWC [closed]

Is there any specific reason as to why salesforce has not provided the equivalent of lightning:container in LWC ? Since lightning:container places the component in an iFrame, is it good to use it (in ...
0 votes
2 answers
244 views

URL Redirection Attack - Source Scanner Results

I have got Query: URL Redirection Attack during Source Scanner. Piece of controller @AuraEnabled public static String forgotPassword(String username, String checkEmailUrl) { try { Site....
  • 11
1 vote
2 answers
227 views

Security review for a managed package with Polymorphic SOQL queries

I checked the documentation "Enable Field- and Object-Level Permissions Checking Using WITH SECURITY_ENFORCED in SOQL Queries". But looks like the below query won't work because traversing a ...
  • 1,254
1 vote
1 answer
224 views

Aura:html tags in component flagged in Security Review

We have received Security review issues for <aura:html tag="style"> used in Lightning component .cmp file. This was done to change the modal width which is opened from Quick Action. &...
0 votes
0 answers
55 views

Not able to reproduce checkmarx scann results using SFDX scanner

We got these below eeors when we submitter our code for security review in salesforce portal In order to fix the issue we are trying to replicate the issues using SFDX scanner in our local but SFDX ...
0 votes
1 answer
113 views

CxSAST URL for VSCode

We are trying to host our application in Appexchange. So before submitting we did scan code review in security portal of salesforce and got some errors. We are trying to fix those issues in our local ...
0 votes
1 answer
33 views

Code Scanner Portal show error in browser console

I try do security scanner for our code. I use this "Force.com Code Scanner Portal" website to do it. This is the website link: https://security.secure.force.com/security/tools/forcecom/...
2 votes
1 answer
358 views

SessionId in LWC for Security Review

I am using this workaround to get the SessionId in my LWC and perform a callout from the JS. I am concerned about if it will pass the security review for managed packages. Have someone used it and can ...
11 votes
0 answers
210 views

Is there a reliable way to have WITH SECURITY_ENFORCED applied to all queries?

I've just gone through a biggish code base making sure that WITH SECURITY_ENFORCED is set on every query. Most were, but for some recent additions, it hadn't been included. For managed packages that ...
  • 131k
1 vote
1 answer
105 views

Query: Password APIs Issue on Salesforce Security Report

We have a scenario to allow the user to reset the password for the community users, We have used the following snippet System.resetPassword(userId, true); So its blocked in the security report under ...
0 votes
1 answer
105 views

Update Lightning API Version

I need to update lightning API version to 40 or more for Open CTI components as it is the requirement of security review. Currently, I have version 38.0. I wanted to know how can I update API version. ...
  • 35

1
2 3 4 5
7