Questions tagged [security-review]
All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.
335
questions
5
votes
2
answers
245
views
Are custom SOQL and DML libs superfluous with USER MODE?
As the Security model of Apex was leaky in the past, everybody who took - or as AppExchange Partners had to take - Security seriously was building or using libraries to enforce CRUD/FLS rules. The ...
- 36.4k
3
votes
1
answer
106
views
Security Review Test Environment - how many users for Salesforce?
Until today I believed that you need to provide at least TWO users to Salesforce to test your app in the Test Environment you submit for Security Review.
I tried to find that rule in an official ...
- 36.4k
0
votes
1
answer
59
views
When is the External Service Scan required in Salesforce Security Review?
I am currently working with a Salesforce integration in which a third-party system creates/updates records in the Salesforce org using the native REST API of Salesforce. It is a unidirectional ...
- 553
1
vote
1
answer
32
views
Self certify that the package is lightning ready
How do I certify that my package is Lightning ready? Is that something that we have to raise the case with the community?
In the checklist, it shows that I have to "Self-certify listing as ...
- 328
1
vote
1
answer
60
views
Salesforce package version creation after resolving the errors
We are planning to publish the package to the appexchange security review process before which we have run through a security scan. The package version is 0.1.0-1. After resolving the errors from the ...
- 328
1
vote
0
answers
31
views
Checkmarx reporting wrong function name?
I just ran a Checkmarx scan today. It reported the following Apex Serious Security Risk:
You can see the report is making a reference to isCreatable(). However, the name of the method in my Apex code ...
- 302
1
vote
0
answers
29
views
'Select Listing Name to Scan' is empty in the Partner Security Portal
As mentioned by @phil in Sending review to the checkmarx where multiple developments are included I have gone to partner security portal.
Though the packages are being displayed in the partner ...
- 328
0
votes
1
answer
23
views
Sending review to the checkmarx where multiple developments are included
I have a org that is connected to the partner community. In this org, there are managed packages, unmanaged packages, and various other developments that includes code that is not required for the ...
- 328
0
votes
0
answers
19
views
How to scan the Second Generation managed package code on Checkmarx Scanner from Partner Security Portal
I have created a second generation managed package using the dev hub org and namespace org and I have connected the dev hub org in the organizations subtab in publishing tab. But when I tried to login ...
- 1
1
vote
0
answers
49
views
What does the Dereferenced Field vulnerability in Security Review scan means?
I've received a vulnerability from Checkmarx scan that is labelled as Dereferenced Field vulnerability.
The scan report message reads like this:
A possible dereference exist in method uploadDocument. ...
- 5,768
2
votes
0
answers
55
views
Why & How to use Burp Suite for Salesforce External Services
I am investigating the possibility of using Burp as an alternative to Chimera or OWASP Zap to provide a scan report of an External Service in the Salesforce Security Review.
The information that I am ...
- 553
0
votes
1
answer
39
views
Managed Package Yearly Security Review
I was under the assumption that after 1 year a managed package should again go thru security review.
However I published a free app that passed the security review at 26-1-2022. Since then I published ...
- 1,659
0
votes
2
answers
37
views
Using SOQL Injection to delete data
I know that SOQL injection can be used to query data the user shouldn't see by providing a value like Bob \' OR Name LIKE '%'. But I'm wondering if you could use an input value like Name LIKE '%')'; ...
- 153
1
vote
0
answers
63
views
Transport False-Positive comments to Checkmarx report
I want to find the best way to address false positives in the Checkmarx report. One of the points I am investigating is how to make the Checkmarx report to display the false positive comment that has ...
- 553
0
votes
0
answers
69
views
Client DOM Code Injection in Lightning Aura Component
The security scanner alert us about client DOM code injection on this lines:
L 3: var orgin = window.location.origin;
L 4: component.set("v.orgin",orgin);
L 5: window.addEventListener("...
- 1
8
votes
0
answers
201
views
Fail Security Review again and again. New process?
I am aware that Salesforce recently changed some rules for Security Review, which makes the life of ISV and PDO partners harder. Here is another one that I am seeing, and ask for some guidance.
In the ...
- 36.4k
0
votes
0
answers
33
views
Salesforce AppExchange - free integration to paid platform
We have a web app that we license per user per month (paid annually). We also built a Salesforce Managed Package that allows Salesforce users to work with our UI inside of iframes on the Opportunity ...
- 431
0
votes
0
answers
15
views
Is MFA for Appexchange Test Drive An Issue?
Submitted a Test Drive for our ISV application to Security Review and got failure because IP Address ranges are too wide, 0.0.0.0 - 255.255.255.255. I thought this was bad advice also but it's in our ...
- 1,486
35
votes
5
answers
2k
views
Call Salesforce API from Apex and not fail Security Review
For years I have used Salesforce APIs from within Apex. Mostly to enhance my apps with Setup automation. So I used the Tooling and Metadata API from code snippets that used UserInfo.getSessionId() and ...
- 36.4k
-1
votes
1
answer
90
views
What happens when Password setting is updated?
I am trying to improve our Salesforce Org Health Check score.
I have one setting "Password complexity requirement" where current value is "Must include alpha and numeric characters"...
- 89
0
votes
0
answers
22
views
How to set isExposed of messagechannel component of released package but not yet approved from security review?
My app has gone through security review for the first time and they failed it stating that the messaging channel component has isExposed to true and that it should be set to false.
Now when I try to ...
- 121
1
vote
1
answer
81
views
If you break ancestry, would you have to start security process from scratch?
If you break ancestry, would you have to start security process from scratch?
I know that if you want to create a package from a different dev hub, you would have to restart the security review ...
- 14.7k
1
vote
2
answers
60
views
What type of product am I submitting for security review?
I am about to submit my Salesforce package (2GP) for security review, and clicking "Start Review" in the Partner Community portal prompts me with a choice:
What type of product are you ...
- 121
0
votes
1
answer
49
views
How to resolve SOQL SOSL Injection security error
I am fairly new to salesforce. I am getting the soql sosl injection error in the below method while doing query. How to resolve this error?
public static Days_Unavailable__c getAvlRecordById(String ...
- 15
0
votes
1
answer
103
views
How do I submit a 2nd generation managed package for security review?
I am trying to get 2nd generation managed package ready for security review. It is not showing up in the devhub org. How do I submit the package. Do I zip up the source code and submit it?
I have ...
- 121
0
votes
0
answers
30
views
Should I release / promote managed 2nd generation before security review or after security review?
Should I release / promote managed 2nd generation before security review or after security review? I am ready for security review but I am confused if I should use the beta versions that I have been ...
- 121
1
vote
0
answers
73
views
Access to Security Portal (Scanner) when building 2GP
I work as a PDO partner for a customer who wants to have an app on App Exchange. We develop a 2GP package, where Dev Hub is located in the customer PBO, which is linked as an organization to App ...
- 81
0
votes
1
answer
59
views
Is fixing "Apex Code Quality" issues necessary for passing security review?
I have fixed all the "Apex Critical Security Risk" issues but there are few apex code quality issues remaining. Some of them are false positives and some are correct. But due to time ...
- 3,355
1
vote
1
answer
135
views
Security Review: Cloud Service uses and stores OAuth tokens
My customer runs a Cloud Service for many years, that connects with Salesforce orgs via OAuth flow and stores org tokens in its database.
As this service wasn't on the AppExchange my customer did not ...
- 36.4k
-1
votes
1
answer
28
views
Which Salesforce scanner tool can I use to scan Chrome Extension(built on Angular utilizing Salesforce APIs)?
We have a Chrome Extension built upon Angular utilizing Salesforce APIs, now We want to publish it on APP Exchange, so we have to upload a scanner report, which scanner tool can we use?
I tried using ...
3
votes
1
answer
233
views
Resubmit for Security Review without Patches
I am working for an existing AppExchange ISV Partner that missed the deadlines for Security Review resubmission. When that happens Salesforce is not only taking your Listing down but also deactivating ...
- 36.4k
6
votes
1
answer
195
views
Best (commercial) Scanner to stay prepared for Security Review
For ISVs to be safe to (re)submit their app for Security Review without issues Checkmarx still is the only authoritative tool. But it is also cumbersome and limited as:
Community Scanner is limited ...
- 36.4k
1
vote
0
answers
148
views
Run Checkmarx on code not in packaging org (too big for Community scanner)
I am consulting an ISV partner with their resubmission of the Salesforce Security Review.
They ran the initial Checkmarx scan using the Partner Scanner on the code in their Packaging org, then fixed ...
- 36.4k
0
votes
0
answers
22
views
Unable to begin Security Review
I have a lightning App which I have scanned using the Checkmarx app, along with a scan with ZAP. However, when I go to the security review tab, the Start Review button is greyed out and the Update ...
5
votes
4
answers
760
views
How different is Initial Security Review from Resubmission
An ISV customer of mine has a Managed Package in the AppExchange for many years now. He recently was asked to resubmit for Security Review and is now wondering what to expect and how to best plan and ...
- 36.4k
0
votes
1
answer
31
views
SOAP Web API scan for underlying API undder my salesforce app
we are using the web API (SOAP) as a backend in our salesforce app. Do I need to attach the ZAP/Burp or Chimera report with my submit material ? or these reports are only required for WebAppliaction . ...
- 109
0
votes
1
answer
40
views
security review payment needed every time a different package is submitted?
does every time I submit a package for review the review fee has to be paid? Or is it just once per year?
- 302
2
votes
0
answers
79
views
How to avoid using position:absolute in stylesheets for aura components due to security concerns as mentioned in the ISV guide
I'm trying to pass security review for my managed package. I have to a security issue to address: Unsafe CSS position declaration: position: absolute;
The Salesforce Platform tries to ensure that ...
2
votes
0
answers
58
views
Possibility to Install a managed package on production while package is under Security Review
We are working on a managed package, which we are planning to submit for security review in a few weeks.
While the package will be in the security review, we would also like to install the managed ...
- 2,342
0
votes
1
answer
104
views
VfUnescapeEl PMD fix for salesforce static resource page
We are getting VfUnescapeEl error in our sfdx report on the following line :
<a href="{!LEFT($CurrentPage.URL,FIND('/',$CurrentPage.URL,9))}{{x.Id}}">...</a>
here, x.id will be ...
- 1
0
votes
1
answer
192
views
Necessity to resolve all PMD issues for security review
We generated a pmd report using sfdx, is it necessary to resolve all the sfdx report issues to pass the salesforce security review or those are just warnings and can be ignored to pass the security ...
0
votes
1
answer
47
views
Does Upgrading Major Version Number Trigger Security Review
We're rolling out a larger change in our manage package and it would be nice to recognise these changes by increasing the Major version number on our package. The concern is whether it will trigger a ...
- 342
0
votes
1
answer
239
views
Why newly released package version is not available in Partner Security Portal scanner?
We have released a new minor 2GMP release version and try to check it for Security and Quality rules in Partner Security Portal scanner, but the new version doesn't show up in the picklist for Select ...
- 14.7k
1
vote
1
answer
88
views
Pass SF security review and keep <apex:pageMessages escape="false"/> in a visualforce page
to pass security review we must avoid <apex:pageMessages escape="false"/>
But without the escape="false", my message will not be clickable anymore.
So inside my controller, I ...
- 11
2
votes
1
answer
79
views
Risks & Benefits of Installing Someone Else's Unlocked 2nd Gen Package
I'm interested in introducing a GitHub project into our enterprise org. That GitHub project currently offers the tool in both Managed Package and Unlocked Package format. The Unlocked Package format ...
- 3,422
0
votes
1
answer
56
views
Is it a liability to use the lightning container npm package? (not been updated for 4 years...)
I have embedded my react app in a lightning container iframe as the docs suggest.
<aura:component access="global" implements="flexipage:availableForAllPageTypes">
<...
- 1
1
vote
1
answer
1k
views
URL Redirect Attack - Apex
I have been trying to fix the below URL Redirection Attack code block but couldn't find a working solution:
String url = '/' + oGenericObj.getDescribe().getKeyPrefix() + '/e';
...
- 450
-2
votes
1
answer
313
views
Security Scanner Report in Owasp zap
How to scan my salesforce app in Owasap zap, need to cover everything such as custom objects, flow, process builder, reports and dashboard, etc. at the end need to generate a report, is possible?
- 13
2
votes
0
answers
118
views
Information Disclosure Vulnerability
Here is a security vulnerability issue of "Information Disclosure" reported by the Salesforce Team.
URL
https://yourdomain.lightning.force.com/aura?r=13&aura.DynamicComponent....
- 397
1
vote
1
answer
168
views
Is there any way to set feature parameters for beta versions which did not pass security review?
Is there any way set feature parameters for package beta versions which did not pass security review?
Assuming you are going to release a new version of package which will include feature parameters.
...
- 14.7k