Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
4
votes
1answer
1k views

How to resolve FLS Create and FLS Update issue as per security scanner

Running the Security Scanner showed the Following Issues In order to avoid it I tried adding the following line if(Schema.sObjectType.SAP_Change_Event_Config__c.isCreateable())- For object ...
2
votes
1answer
32 views

Connected App consumerKey Security Review issue

We have two connected apps that are part of a managed package that is up for review. One app is used for API access to Salesforce from an external web platform, and the other is used as a CanvasApp ...
2
votes
1answer
26 views

Do we have to force all FFLIB classes with `with sharing` keywords to pass security review?

I'm using FFLIB classes in my managed package and i just wanted to know if i should mark FFLIB classes use in my package with with sharing keyword to follow security review requirements ? Thanks,
-1
votes
1answer
21 views

CRUD/FLS checks on Dynamic SOQL - Needed for WHERE clause? [duplicate]

For the AppExchange Security Review, do we need to check FLS on a Dynamic SOQL WHERE clause as well? Ex: If Contact.My_Custom_Field__c is not visible to the logged in user, then the following SOQL ...
11
votes
2answers
363 views

Security Review Preparation: Checking isAccessible on each object and field in complex SOQL queries for whole codebase

We are preparing our managed package for security review. And as a part of this we need to enforce not just create/update/delete but also read (i.e. select) permissions. That means basically checking ...
0
votes
2answers
75 views

Locker Service and 3rd party library, how to pass Security review?

Is it a way to use 3rd party library/framework like Vue/Angular and bypass security review by Salesforce. Because only option to use those kind of library seems possible with version 39.0 which is ...
3
votes
2answers
49 views

Second-Generation Managed Package Security Review

Generally, the question stands as what steps need to be done in order to send 2-nd generation managed package for security review. Current conditions: I have developed 2-nd generation managed ...
9
votes
3answers
187 views

How to best enforce CRUD/FLS and pass Security Review in 2019

Since Salesforce began to require CRUD / FLS checks as part of the Security Review for AppEchange apps in 2015 there has been a lot of discussions why this cannot be done by the platform and how this ...
2
votes
1answer
34 views

Do I need to define sharing for test classes?

The question is simple: should test classes be defined with sharing with sharing | without sharing | inherited sharing to pass the security review? Technically Salesforce enforces this by saying it ...
3
votes
2answers
56 views

Do I need to define sharing for inner classes?

In preparation to Security Review I am checking that all my classes follow instructions from Sharing in Apex Classes. Now I am wondering do inner classes also need to be defined as with sharing | ...
3
votes
2answers
778 views

Security review sample “False positive document”

We are submitting our app for security review. We have an ASP.Net web application that consumes few Salesforce APIs. The Burp scanner raised few OS, Ruby, Python and PHP injection errors. But we don't ...
3
votes
1answer
40 views

Is Jest mandatory in LWC For appExchange app

As SF stated Jest is independent of Salesforce and doesn't run in web browser. Is it mandatory to write coverage/unit testing for Lightning Web Components and add in bundle while creating manage ...
3
votes
0answers
31 views

Auth. Providers and Named Credentilas for Salesforce Security Review

We have managed package, where in we are asking users to configure Auth. Providers,Named Credentials after package installation as user might need to change endpoint when user have to connect to ...
4
votes
1answer
85 views

Apex Source Scanner flag CRUD/ FLS as security risk for no reason

I've been using FFLIB_SecurityUtils lib to enforce CRUD and FLS in my apex classes. I've no issues when running unit tests, but when submitting my code on Source Scanner for partners, i've several ...
3
votes
0answers
32 views

Integrate external app using IFrame (not Canvas) and Security review

I have a customer that wants to integrate an external Java App with a Managed Package. As the endpoint (domain name) of the external Java App(s) is not static but differs from customer to customer we ...
5
votes
0answers
26 views

Does lightning beta tags pass security review? [duplicate]

There is lightning:tabset and lightning:tab tags which are still in beta as of now. If we use them while developing an app exchange product do they pass security review? Can we use them in production?
0
votes
0answers
15 views

Scan AWS3/ API Gateway web services to pass Salesforce security review

I'm struggling to find a way to scan 2 web-services callout used from my managed package to pass the security review successfully. I've tried to use Burp to do so, but i didn't find a way to scan ws ...
-1
votes
1answer
27 views

Publish App exchange application with Scanning [duplicate]

I have created a Lightning component And Add in App Exchange my partner community. So I have passed my component in a security review. Now I can use SOURCE SCANNER for Apex class and visual force ...
2
votes
0answers
20 views

How to register an external app in appexchange marketplace

We have an external .net application which connects into SF using API. We want to sell this app on appexchange. What are steps that need to be taken to list it on appexchange? How does the security ...
4
votes
0answers
47 views

Force.com Site and custom user authorization - Is it allowed and when? [duplicate]

Assume I am going to build a customer facing website where users have some access to Salesforce Standard and custom objects. Because it's expensive I don't want to give them Salesforce licenses. I ...
1
vote
1answer
660 views

Use Strict Transport Security (HSTS) with Salesforce

We are having a third party do security testing for our Salesforce community and one of their suggestions was to "utilize the "Strict-Transport-Security" response header across the entire domain as a ...
6
votes
1answer
678 views

Are external iframes in lightning experience kosher from a security review perspective?

We are looking to embed an external page in lightning experience. I'm trying to understand if a canvas app or an iframe is the recommended approach from a security review perspective for our use-case. ...
0
votes
0answers
19 views

Console Sidebar Component Insufficient Privileges

I have installed a managed package and now I need to uninstall, there is one visualforce page from this managed package referenced/used on "Console Sidebar Component", when I am clicking on the label ...
1
vote
1answer
880 views

Difference between Lightning and HTML input tag elements

Case 1 ( works fine) lightning code <lightning:input type="file" label="Mapping" name="Mapping" multiple="false" accept=".csv" onchange="{! c.readCSV }"></lightning:input> after render ...
3
votes
3answers
186 views

Public Salesforce Site and Security Review

Let's face it. Salesforce Communities is expensive and not for everyone out there. I have a customer who wants to create a customer-facing site where non-logged in users can register themselves and ...
2
votes
0answers
30 views

Javascript in Static Resources for security review but requires parameter

I have a package that was submitted for security review which requires JS to be in static resources. Required: all script and style resources must be loaded through static resources Do not load ...
1
vote
1answer
467 views

Alternative to String.escapeSingleQuotes to avoid XSS

I have a few places in my code that were flagged as "Stored XSS" and "Reflected XSS" respectively. Here's an example of a "Stored XSS" vulnerability: Database.query('select Id, Name, Email from ...
1
vote
1answer
33 views

Remove Sample Code references in Managed package metadata

One of our partners reached out to us in helping their package pass security review. The recent report they received contains the following issue: Sample Code in Production Account.object Issue ...
1
vote
0answers
31 views

CRUD/FLS Enforcement for configuration tables like FiscalYearSettings

Is Field Level Security enforcement a requirement for querying tables like 'FiscalYearSettings' and 'Period'? or only for tables like Opportunity and Contact. Our app need to display the fiscal year ...
1
vote
0answers
44 views

Building managed package using JS frameworks/library

I'm trying to do an analysis of an existing managed package that we have built currently we have a bunch of VF pages and Lightning Components. At end of this analysis, we want to determine which JS ...
3
votes
2answers
628 views

CRUD and FLS enforcement

I have an Account list and I want to update it. I want to testing object and field level security enforcement but I'm wondering what I have to test : 1 - if Account object is updatable ? (if it's ...
6
votes
1answer
148 views

Why use ESAPI for encoding?

We're working on getting out managed package to pass security review. In various documentation (including trailhead) Salesforce are recommending we use ESAPI for server side (apex) encoding. My ...
0
votes
2answers
56 views

What should I do to resolve salesforce security review?

I had run a security review for my apex code. It returned a number of FLS update error in the result. I have changed/implemented code (see below the code snippet) but the error is still there. Please ...
0
votes
1answer
28 views

Securely storing and retrieving google maps api key for appexchange app

i am planning to use google maps in one of appexchange apps. We need to store and retrieve the api key to be used for google maps. The end client would have to enter the key that they had signed up ...
4
votes
1answer
609 views

Error logging in to Chimera and got error. Please suggest

When we tried to logging in Chimera, but got the following error. We want to scan our code before security and technical review process. Please suggest. Problem Logging In We can’t log you in ...
3
votes
2answers
184 views

Is a component only launched from a quick action safe from CSRF?

I've got a component that is launched from a quick action and on init preforms some DML and redirects the user. It only implements these three interfaces and is not referenced anywhere else in the ...
1
vote
1answer
51 views

Can any package can be both managed, and installable in production, without requiring appexchange security review?

Can any package can be both managed, and installable in production without appexchange security review? Assume a beta tester wants to beta the managed app in production. According to "Beta Versions ...
1
vote
1answer
201 views

Risk of CSRF In Lightning Applications

Could a package fail security review due to a lightning application that executes an initialization action on load that creates a record? e.g. user visits https://[instance].lightning.force.com/c/...
1
vote
2answers
117 views

Do we need to check FLS for Record Id field in apex?

We are submitting our application for Security review so we have to check FLS/CURD so we have a query like below. Account ac = [SELECT id, Name From Account limit 1]; so do we need to check ...
1
vote
2answers
38 views

Security review issue “Password Echo”

I have submitted to my app to security review, it resulted me "Password Echo" issue. App consists of a protected custom settings to store the username and password. we have implemented UI to insert/...
0
votes
1answer
86 views

Iframe in manage pacakge

I want to create an appexchange app. In that app, external site page(other system's page) will be shown under salesforce tab. To show external site page in visualforce page/lightning component, i will ...
4
votes
2answers
203 views

Usage of let keyword, JS fat arrow & JS functional constructs in Lightning component

Does Salesforce security review reject a package/ lightning component if the following are used in lightning component code? (a) let keyword, instead of var (b) JS fat arrow (=>) within the controller/...
1
vote
1answer
54 views

Security review vs lightning readiness [closed]

We're in the process of submitting the ap through Salesforce Security Review and kind of unsure if Lightning Readiness Report is important to pass the review. Can someone shed some light on this?
3
votes
0answers
85 views

How to generate scan results for the external endpoints to pass salesforce security review?

I have build Salesforce appexchange app and i have used amazon s3 server api to store files in amazon server. I have generated the report for security and quality check but i dont know how to generate ...
0
votes
0answers
356 views

HTTP Form Post to external website from Lightning Component

I am working with a client to develop a managed package. Here is the requirement in brief: User clicks a button in a lightning component which is added to Contact detail page. The button click ...
1
vote
1answer
69 views

Enforce Shield encryption, still valid for security review?

Just went through Security Requirements Checklist (https://developer.salesforce.com/page/Requirements_Checklist) in order to verify things that could be detected as a vulnerability in our app for ...
0
votes
1answer
84 views

RichText area field not eliminating XSS issue in checkmarx

I am writing escape=false in my VF Page like this. <apex:outputText escape="false" value="{!cr.Message__c}" rendered="{!(cr.Message__c)!= ''}"/><br/><br/> The Mesage__c is a custom ...
1
vote
1answer
109 views

Query: Hardcoding Of Trigger New

I have wrote an trigger which works fine functionality wise but when we send our product for security review it says Query: Hardcoding Of Trigger New Below is my trigger trigger CostTrigger on ...
1
vote
1answer
253 views

Salesforce security review - ID field fls create

In salesforce security review am getting a error FLS create which is for ID field. so when a FLS create error occurred, validated the isCreateable or isUpdatebale for update condtion. Here how to ...
2
votes
1answer
169 views

How much time Salesforce takes to Review a lightning app before uploading that on AppExchange?

I am working on lightning app and want to upload that on AppExchange. For this, I have followed the process described in Trailhead. But I am not sure about how much time its takes in review of that ...