Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
0
votes
1answer
32 views

Performing DML from a aura component's init handler [closed]

Performing DML from a aura component's init handler and the component is firing from a quick action of a record detail. Is this a security vulnerability for salesforce? Points to consider: The ...
1
vote
1answer
18 views

not checking for Id in FLS checks before query and DML [duplicate]

I am not checking for Id in FLS checks before query and DML. Is this a security review vulnerability in salesforce?
0
votes
1answer
25 views

What are Aura: Aysnc Code and Sharing Violation vulnerabilities from the security review of the application(AppExchange)

I was creating an application to publish in app exchange and so I had submitted the application for security review but the report cointained:- We have completed the security review of your ...
11
votes
4answers
1k views

How to best enforce CRUD/FLS and pass Security Review

Since Salesforce began to require CRUD / FLS checks as part of the Security Review for AppEchange apps in 2015 there has been a lot of discussions why this cannot be done by the platform and how this ...
1
vote
1answer
1k views

Difference between Lightning and HTML input tag elements

Case 1 ( works fine) lightning code <lightning:input type="file" label="Mapping" name="Mapping" multiple="false" accept=".csv" onchange="{! c.readCSV }"></lightning:input> after render ...
0
votes
0answers
33 views

Getting “Lightning: CSS Outside Component” vulnerability in security review

As in salesforce security review report, it's mentioned that we should not use float or position: absolute or fixed. Uses non-standard positioning (via float or position: absolute or fixed) breaks ...
4
votes
1answer
91 views

Make Visualforce variable in Javascript pass Security Review

The following Javascript is embedded into a Visualforce page because it relies on Visualforce variables: <apex:page controller="myController" > <script> var foo1 =...
2
votes
1answer
16 views

Recommended explicit sharing declaration for inner classes

In our last Salesforce Security Review we have faced an issue related to the ommitted sharing declarations of inner classes acting as a wrapper. We have passed this review for years so I guess some ...
6
votes
1answer
151 views

Package review fails with new undocumented issues

My Managed package (yearly) Security Review failed with new issues I was not aware of and which I could not find documented anywhere, E.g.: Stored XSS - "Avoid using escape=false unless ...
0
votes
0answers
30 views

Where can we get appexchange before payment coupon codes?

I am about to submit my app for security review, in payment page i could see coupon code available. I would like to get one. so where can I get one coupon code ? Also from the security review video ...
2
votes
2answers
87 views

Security Review - False Positive for SOQL Injection - Configuration Data (Input only by System Admin User)

I am using a dynamic query in one of our AppExchange products. There is an LWC component within our app, which has a property called filterLogic as below: <targetConfig targets="...
3
votes
2answers
63 views

Filtering JavaScript out of HTML

A recent Salesforce Security review flagged the case of inserting this directly into a database text field: <h1>Hello</h1> <img src=x onerror=alert(document.cookie)> <h1>World&...
1
vote
1answer
43 views

Checkmarx Security Scanner FLS Issues

I run the checkmarx scanner for app and received ~250 FLS issues, which is understood, because when the app developed it simply was not checked. However I have noticed that there are lots of cases ...
0
votes
0answers
15 views

Manage Packages Listing With Dependency?

I am currently building a app to publish in market, done with with my development based on 2gp model, but I am confused on final listing for security review that, Which package needs to be on listing ...
1
vote
0answers
30 views

Will deprecated classes raise any security issues?

I submitted my managed package for a security review few days ago. After submitting, I found out that I don't have to use an Apex class in the package. So, I tried to delete that class but couldn't ...
2
votes
2answers
66 views

Consolidate Multiple Manage Packages With Dependency?

I am currently building a app to publish in market, done with with my development based on 2gp model, but I am confused on final package creation that Should i need to create single manage package ...
1
vote
1answer
44 views

Managed Package - Protected Custom Setting for storing creds - Security review

I have created a managed package where I used a protected Custom Setting of hierarchy type to store some user credentials. I am concerned about security review of the app. Is there any chances of ...
1
vote
1answer
105 views

Lightning - Security review problems

We are using the following css in one of our component. In security review it throws an error as follows. 1)Lightning: CSS Outside Component Code: .THIS.wrapper-app > lightning-spinner { ...
1
vote
1answer
58 views

Managed Package, Security Review and LWC DOM Manipulation

I started developing a managed package and I need to manipulate the DOM in a Lightning Web Component, In the component HTML, I added lwc:dom="manual" to the target element and everything ...
0
votes
0answers
66 views

Getting checkmarx FLS_Create Error in apex

Checkmarx is giving me the FLS_Create error in the below code. cv.PathOnClient = docName; cv.VersionData = requestbody; cv.ContentLocation = 'S'; cv....
5
votes
2answers
1k views

How to OWASP ZAP scan external REST API using OAuth2

I have built a Managed Package that talks to an external REST API using OAuth2 Named Credentials. I now want to submit this app for Security Review. I can't use the Chimera Scanner as it would require ...
0
votes
0answers
31 views

Has anyone used Lightning Out with a managed package?

I am working on an integration with a trading and rebalancing platform for a provider who also uses Salesforce Sales & Service cloud to manage their internal operations. This provider has added ...
5
votes
3answers
382 views

Second-Generation Managed Package Security Review

Generally, the question stands as what steps need to be done in order to send 2-nd generation managed package for security review. Current conditions: I have developed 2-nd generation managed ...
11
votes
3answers
754 views

Security Review Preparation: Checking isAccessible on each object and field in complex SOQL queries for whole codebase

We are preparing our managed package for security review. And as a part of this we need to enforce not just create/update/delete but also read (i.e. select) permissions. That means basically checking ...
1
vote
1answer
64 views

How to remove Salesforce CRUD Delete Security Risk?

When I scanned my app yesterday, and it raised a bunch of CRUD Delete security issue. So, I added isDeletable() check to all the delete query, and scanned it again. Still, it showed the same security ...
1
vote
1answer
263 views

Is it necessary to check isUpdatable() when process run in system mode/trigger to pass security review process

In salesforce, we have a scenario, on the trigger of the lead object we are updating some records of Campaign. But the user on the behalf of we are running the trigger does not have edit permissions ...
5
votes
1answer
691 views

Is it possible to package a Canvas app where the Canvas App URL differs on a per-install basis?

We are currently working creating a managed package which integrates with a third-party service through Canvas. The third-party service has different URLs for different users (similar to how ...
4
votes
1answer
175 views

Will an app where all the Apex is “without sharing” pass a Salesforce Security Review?

We are working on a portal app that will run inside a Community and the limited sharing rule capabilities of the lowest priced Communities licenses is making life difficult, particularly as this app ...
0
votes
1answer
131 views

Deploy FLS settings for standard object's custom field in managed package

I've added a custom field to Activity object for using it during Task creation/updating from Apex code. By default when I deploy my project through SFDX this field has no FLS settings. In the result I ...
0
votes
1answer
702 views

Restrict Access to @AuraEnabled Apex Methods for Authenticated Users Based on User Profile [closed]

This update is getting enforce in my org on the 5th of April 202o, since some of the updates in my org are having deactivation options after enforcement and some of them are not having. so I want to ...
1
vote
1answer
1k views

Secure Object Permissions for Guest Users (Security Alert) May 2020

I am a little bit confused with this security alert that will take place in May of 2020. Within the sandbox they only list 3 objects, where this update will be affected Contracts, Order, and ...
3
votes
1answer
150 views

Endless loop of Chimera scans with failure

Today I started a Chimera scan from https://security.secure.force.com/sourcescanner/chimera__chimera_portal to scan an external API we use in an ISV app which is going into Security Review soon. ...
2
votes
2answers
48 views

SF Lightning and Angular (versions 7) — Any concerns on the App Exchange

I am trying to write an application in SF Lightning that uses angular (not angularjs, angular, version 7 if it matters) as the front end. To handle this (since it truly is a separate app that is ...
2
votes
0answers
260 views

Chimera Token not getting detected in apache

I have uploaded the token, and it is accessible via http://ksinkar.edubrite.us/ChimeraToken.txt But somehow Chimera scanner is not finding it, can you please assist whats wrong here? This is the ...
6
votes
2answers
3k views

How to resolve FLS Create and FLS Update issue as per security scanner

Running the Security Scanner showed the Following Issues In order to avoid it I tried adding the following line if(Schema.sObjectType.SAP_Change_Event_Config__c.isCreateable())- For object and not ...
0
votes
0answers
53 views

Cross-Site Scripting in visual force input

We have received a security warning regarding Cross-Site Scripting for below input : <apex:inputtext value="{!mergeText}" id="txtField" disabled="true" size="25"/> What changes are required to ...
3
votes
1answer
2k views

Export a CSV using lightning Component without DOM modification

Lightning Controller getData : function(component, file, fileContents) { var action = component.get("c.data"); action.setCallback(this, function(response) { var state = ...
7
votes
3answers
1k views

Do we need to check CRUD permissions on custom metadata type/custom setting to pass the AppExchange security review

I have an application that we need to upload on AppExchnage but we need to pass the security review so I have a query on the custom metadata type so do we need to check the isAccessible() permission ...
0
votes
1answer
115 views

Managed package and security review

We have developed a solution that we want to distribute as ISV on AppExchange. What happens if we have people install those packages while they are in review? Do customers need to reinstall our ...
2
votes
2answers
108 views

Connected App consumerKey Security Review issue

We have two connected apps that are part of a managed package that is up for review. One app is used for API access to Salesforce from an external web platform, and the other is used as a CanvasApp ...
2
votes
1answer
59 views

Do we have to force all FFLIB classes with `with sharing` keywords to pass security review?

I'm using FFLIB classes in my managed package and i just wanted to know if i should mark FFLIB classes use in my package with with sharing keyword to follow security review requirements ? Thanks,
-1
votes
1answer
126 views

CRUD/FLS checks on Dynamic SOQL - Needed for WHERE clause? [duplicate]

For the AppExchange Security Review, do we need to check FLS on a Dynamic SOQL WHERE clause as well? Ex: If Contact.My_Custom_Field__c is not visible to the logged in user, then the following SOQL ...
0
votes
2answers
529 views

Locker Service and 3rd party library, how to pass Security review?

Is it a way to use 3rd party library/framework like Vue/Angular and bypass security review by Salesforce. Because only option to use those kind of library seems possible with version 39.0 which is ...
3
votes
1answer
110 views

Do I need to define sharing for test classes?

The question is simple: should test classes be defined with sharing with sharing | without sharing | inherited sharing to pass the security review? Technically Salesforce enforces this by saying it ...
3
votes
2answers
183 views

Do I need to define sharing for inner classes?

In preparation to Security Review I am checking that all my classes follow instructions from Sharing in Apex Classes. Now I am wondering do inner classes also need to be defined as with sharing | ...
3
votes
2answers
915 views

Security review sample “False positive document”

We are submitting our app for security review. We have an ASP.Net web application that consumes few Salesforce APIs. The Burp scanner raised few OS, Ruby, Python and PHP injection errors. But we don't ...
5
votes
1answer
181 views

Is Jest mandatory in LWC For appExchange app

As SF stated Jest is independent of Salesforce and doesn't run in web browser. Is it mandatory to write coverage/unit testing for Lightning Web Components and add in bundle while creating manage ...
5
votes
0answers
94 views

Auth. Providers and Named Credentilas for Salesforce Security Review

We have managed package, where in we are asking users to configure Auth. Providers,Named Credentials after package installation as user might need to change endpoint when user have to connect to ...
4
votes
1answer
270 views

Apex Source Scanner flag CRUD/ FLS as security risk for no reason

I've been using FFLIB_SecurityUtils lib to enforce CRUD and FLS in my apex classes. I've no issues when running unit tests, but when submitting my code on Source Scanner for partners, i've several ...
3
votes
0answers
103 views

Integrate external app using IFrame (not Canvas) and Security review

I have a customer that wants to integrate an external Java App with a Managed Package. As the endpoint (domain name) of the external Java App(s) is not static but differs from customer to customer we ...

1
2 3 4 5 6