Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
9
votes
1answer
3k views

Get a FIRST-CLASS SessionID for API Calls (looking for a clean way or alternative)

I am basically facing the same challenge as @Evan here Different Session Ids in Different contexts I'm also running into SessionID related issues, but in a completely different use case. Background ...
3
votes
3answers
1k views

App Exchange Lightning ready concept

We are planning to submit our app in app exchange and we are currently in security review step. They have asked us to confirm that our app is lightning ready and asked us few screenshots of the app in ...
11
votes
2answers
1k views

Sanitizing global string attributes - necessary or not?

Here is a DOM-based XSS flaw reported by SalesForce Security Review team in our code: RootComponent <aura:component extensible="true" abstract="true" access="global" description="...
9
votes
1answer
861 views

Security Review - CRUD/FLS Checks for every SOQL Query

I know this sounds like a standard question, so please bear with me. Recently our Security Reviews fail due to CRUD/FLS violations. The highlighted codelines include almost every SOQL Query in the ...
6
votes
1answer
518 views

Anyone have examples of genuine security issues identified by the Burp Scanner for external web services called via Apex?

Thanks to this blog post Using the Burp Suite to test a Web Service that is consumed in a Salesforce app I believe I have successfully scanned the two web services that my managed package calls. (This ...
18
votes
1answer
950 views

How does Salesforce classify an app as 'Salesforce1 ready'?

As part of the Salesforce1 announcement, Salesforce showcased a list of apps on AppExchange that are 'Salesforce1 ready'. This includes several popular apps such as Box, Concur etc. I want to know how ...
11
votes
1answer
1k views

BURP Scanning a managed package

Salesforce have asked me to do a BURP Scan on my managed package before I submit it to the AppExchange. My Managed Package is built on the Force.com platform. It does perform a couple of callouts to ...
3
votes
1answer
7k views

How do I fix Stored XSS and Reflected XSS?

When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and ...
9
votes
1answer
1k views

Security Scanner finds XSS False Positives / JSENCODE incompatible with Boolean fields?

Before I submit my app for Security Review I checked it with the free scanner. It marked the following line of JS-code in a Visualforce as Critical XSS vulnerability: <script>var trueOrFalse = '...
6
votes
1answer
531 views

Security Review: Illegal DOM Access in Lightning Component

I submitted a lightning component to the Security Review. They reported an issue regarding Illegal DOM Access. I used the following code in my helper and security review team reported it has an issue....
4
votes
1answer
1k views

“Multiple Forms In Visualforce Page” caught by Checkmarx scanner

One of my pages was scanned by Checkmarx and it's returning this flag "Multiple Forms In Visualforce Page" Indeed in my page I have several form tags like so: <apex:outputPanel rendered="{! $...
0
votes
0answers
47 views

Security Review-Requirements [closed]

We submitted for security review yesterday,and they have sent a mail saying few reports are not being uploaded like ZAP and also few Composite piece(s) of your application was not accessible What ...
6
votes
1answer
2k views

Lightning Components Do NOT Use React?

The combination of Lightning Component and React is NG? Is my understanding of this correct? https://developer.salesforce.com/page/Requirements_Checklist Use of third party MV * frameworks is not ...
5
votes
1answer
3k views

Informational Issues in BURP Scan Report

I tested my app with BURP scan tool.It shows me some informational issues having confidence level of 'Firm' and 'Certain'.It has no Low,Medium and High Issues.So what I want whether is it good enough ...
4
votes
1answer
308 views

DOM modification feasibility in lightning

I want to implement Auto Compete in lightning, for this I have to use jQuery and jQueryUI and I have to directly modify DOM of component as well. Will it be allowed by the Salesforce ? Will is cause ...
12
votes
2answers
1k views

Rolling back a managed released package?

We have a managed released package currently undergoing security review. While that is happening, we would like to make some changes to the tab layout of our application. Unfortunately, it seems that ...
8
votes
4answers
943 views

Genuine SOQL Injection issue or False Positive?

Trying to work out if this a valid issue with my code, or just a false positive I can note in report for Security Review. I have provided a slightly simplified version below. The Id I am querying for ...
3
votes
1answer
2k views

CRUD permission check Security Review with SOQL queries needed?

The CRUD permission check for Security Review has been imposed recently, though I'm clear on the DML statement and Create/Update/Delete permissions I need to check for in my code, but I'm not clear ...
3
votes
1answer
2k views

Export a CSV using lightning Component without DOM modification

Lightning Controller getData : function(component, file, fileContents) { var action = component.get("c.data"); action.setCallback(this, function(response) { var state = ...
6
votes
2answers
1k views

Checkmarx Force.com Security Source Scanner - any way to mark known false-positives?

For the Force.com Security Source Scanner, is there a mechanism of the same nature as eslint-disable-line for inhibiting known false-positive reports? With the false positives excluded, future scans ...
4
votes
2answers
3k views

Is Jquery search allowed in Lightning component framework for Security Review

In our application we have a use case where we need to search elements using Jquery as following In the controller : var Id = 'groupInput'+component.get("v.comp_suffx"); var GroupInputVal = $("#"+...
3
votes
1answer
267 views

Salesforce Security Review Field Object (CRUD) and FLS are configured on profiles [closed]

Submitted our package security review few days ago and received the following message from Salesforce Object (CRUD) and Field Level Security (FLS) are configured on profiles and can be used to ...
2
votes
1answer
417 views

Chimera Security Review not finding anti-abuse token for Heroku NodeJs application

I'm trying to review a Nodejs web application as part of an SF app exchange registration - using Chimera. First hurdle is the review keeps coming back unable to verify it's my app. I've uploaded ...
2
votes
2answers
4k views

How to display custom HTML in my Visualforce Page

I created a visualforce page, and i get some data(HTML) from webservice and store it in Custom Object as LongText, When i retrieve it and display in my visual force page something like this <apex:...
2
votes
1answer
878 views

“Client Cross Frame Scripting Attack” flagged by Checkmarx scanner

I have a page where the users can click a link which opens a popup window to start the OAuth connection/flow. However this page is getting flagged by the Checkmarx scanner as a possible "Client Cross ...
1
vote
1answer
164 views

Salesforce Security Review Error - Possible XSS / escape='false'

Salesforce Security Review Error - Possible XSS / escape='false' : How to solve this issue for the below set of line $calEvent.find(".wc-time").html(calEvent.status+"<br/> <div style='font-...
1
vote
1answer
84 views

Is it necessary to check isUpdatable() when process run in system mode/trigger to pass security review process

In salesforce, we have a scenario, on the trigger of the lead object we are updating some records of Campaign. But the user on the behalf of we are running the trigger does not have edit permissions ...
1
vote
2answers
532 views

Alternatives for innerHTML in jQuery

This might seem a question not related to this forum. But, according to Salesforce Security reviews, we are not supposed to use innerHTML in our code. Since, this could cause Cross-Site-Scripting(...