Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

54 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
30
votes
0answers
439 views

Mini Page Layout Hovers in Managed Package

Has anyone using the mini page layout popup technique listed here in a managed package had the package rejected in security review because of it? This is obviously an unsupported technique, but given ...
5
votes
0answers
94 views

Auth. Providers and Named Credentilas for Salesforce Security Review

We have managed package, where in we are asking users to configure Auth. Providers,Named Credentials after package installation as user might need to change endpoint when user have to connect to ...
4
votes
0answers
166 views

Unable to simulate FLS/CRUD security leaks although no checks in code

I recently checked my managed package using the Force.com Security chechker (by Checkmarx) and the tool listed a few CRUD and FLS issues in my Controller classes. Before fixing them I tried to better ...
4
votes
0answers
430 views

How to Address DOM-based XSS from Security Review

I have a remoting function on my page that takes a list of contacts, and displays them in on Lightning Design styled page. It works fine, but the final innerHTML statement gets flagged in security ...
3
votes
0answers
103 views

Integrate external app using IFrame (not Canvas) and Security review

I have a customer that wants to integrate an external Java App with a Managed Package. As the endpoint (domain name) of the external Java App(s) is not static but differs from customer to customer we ...
3
votes
0answers
116 views

How to generate scan results for the external endpoints to pass salesforce security review?

I have build Salesforce appexchange app and i have used amazon s3 server api to store files in amazon server. I have generated the report for security and quality check but i dont know how to generate ...
3
votes
0answers
118 views

Burp Scanner-License Issue. Experts suggestions please

We are planning to submit our app in AppExchange. We have succeeded in generating ZAP but we were also asked to submit BURP Scanner report. But the issue with Burp is that, the professional edition ...
2
votes
0answers
31 views

How to register an external app in appexchange marketplace

We have an external .net application which connects into SF using API. We want to sell this app on appexchange. What are steps that need to be taken to list it on appexchange? How does the security ...
2
votes
0answers
93 views

Javascript in Static Resources for security review but requires parameter

I have a package that was submitted for security review which requires JS to be in static resources. Required: all script and style resources must be loaded through static resources Do not load ...
2
votes
0answers
68 views

CRUD-FLS Implementation for Event Object

We are creating a managed package and have submitted for Security review process. We had implemented CRUD-FLS check on all the objects we had used within our application except EVENT. But we had ...
2
votes
1answer
154 views

How do i empty the value in lightning without violating DOM Modification

Component <input onchange="{! c.readCSV}" accept=".csv" type="file" id="file-upload" aura:id="file-upload"/> Controller readCSV : function(component, event, helper){ var file = component....
2
votes
1answer
239 views

Enforce FLS/CRUD Delete issue in security scan

I am getting problem in understanding a issue given by security scan. The problem is : [] I am not pasting the whole code but the essential lines: public with sharing class ...
2
votes
0answers
257 views

Chimera Token not getting detected in apache

I have uploaded the token, and it is accessible via http://ksinkar.edubrite.us/ChimeraToken.txt But somehow Chimera scanner is not finding it, can you please assist whats wrong here? This is the ...
2
votes
0answers
110 views

Security review with third party integration

I'm working on a managed package that we want to publish on the AppExchange. The application has an integration (using a webservice) with a third party application that is not related to Salesforce in ...
2
votes
0answers
126 views

Firing event in renderer issue

I am using highcharts in my lightning components which is embedded in a lightning app. When clicking on the chart , I am firing an event. the method to draw the chart is called from renderer. And the ...
2
votes
0answers
135 views

Marketing cloud hubexchange app's security review

I recently hear the news that Salesforce is asking for the security review of hubexchange apps.I'm not sure this is only for security purpose or they are migrating the hubexchange apps to appexchange. ...
2
votes
1answer
188 views

Salesforce Security Review documentation

I want to know if their is any proper documentation format that I have to follow for security review. I have searched for the document format and got this link https://developer.salesforce.com/page/...
1
vote
0answers
30 views

Will deprecated classes raise any security issues?

I submitted my managed package for a security review few days ago. After submitting, I found out that I don't have to use an Apex class in the package. So, I tried to delete that class but couldn't ...
1
vote
1answer
99 views

Lightning - Security review problems

We are using the following css in one of our component. In security review it throws an error as follows. 1)Lightning: CSS Outside Component Code: .THIS.wrapper-app > lightning-spinner { ...
1
vote
0answers
32 views

CRUD/FLS Enforcement for configuration tables like FiscalYearSettings

Is Field Level Security enforcement a requirement for querying tables like 'FiscalYearSettings' and 'Period'? or only for tables like Opportunity and Contact. Our app need to display the fiscal year ...
1
vote
0answers
55 views

Building managed package using JS frameworks/library

I'm trying to do an analysis of an existing managed package that we have built currently we have a bunch of VF pages and Lightning Components. At end of this analysis, we want to determine which JS ...
1
vote
0answers
27 views

Loading resources dynamically with a link or script tag for google chart allowed?

Our App did not pass the App Exchange security review because of the following issue JS not in Static Resource For jquery and datatables there is a officially accepted source file to load data ...
1
vote
0answers
122 views

security review: chimera report - Cross-Domain JavaScript Source File Inclusion

I'm preparing for my first security review for an application which has an external web app. I'm looking at the Chimera report and I'm seeing the error: Cross-Domain JavaScript Source File Inclusion. ...
1
vote
0answers
128 views

FLS/CRUD Enforcement In Helper Classes

We have several controller classes that call out to helper classes to grab data or save data. This has resulted in a few questions... Is it sufficient to simply check all permissions in the ...
1
vote
1answer
1k views

Difference between Lightning and HTML input tag elements

Case 1 ( works fine) lightning code <lightning:input type="file" label="Mapping" name="Mapping" multiple="false" accept=".csv" onchange="{! c.readCSV }"></lightning:input> after render ...
1
vote
0answers
651 views

Unable to query PermissionSetAssignment object

I have a method in my package's postInstall script that is trying to check to see if the user has access to edit custom settings. In the method, I query the PermissionSetAssignment object. When I run ...
1
vote
0answers
158 views

FLS Update for id field

In the case of record update, we will use the Id field to specify Id value. How to check FLS for Id field. I have already check isAccesible method. But still, it shows in the security scanner. Is it a ...
1
vote
0answers
190 views

XSS: Best way to encode href for anchor tags

What would be the best way to sanitize a user input for href on anchor tags? I've been looking at this library that is created and approved by Salesforce (SecureFilters) Looking at the different ...
1
vote
0answers
30 views

Security review team for AppExchange will stress test the app? Any thoughts please

We are about to submit an app for the security review. I am wondering whether the security review team will do any stress or performance test on the app? What are they actually do with our code or app?...
1
vote
1answer
62 views

Security Review expectations on Logout Configuration

Our app did not pass Security Review because "The logout function doesn't perform correctly the removal of session data server-side." Our application uses the popular Devise gem (Ruby on Rails) to ...
1
vote
1answer
55 views

Error when installing a managed Beta package on a DE Sandbox

The description of a managed beta package reads: "use to test and validate this package internally and with selected customers before release. Note: this type of package can only be installed in ...
1
vote
0answers
63 views

Security Review without AppExchange listing

We are currently distributing managed packages to our customers without any appexchange listing and hence without paying sales commission to Salesforce. A potential new customer now requires our ...
1
vote
1answer
54 views

Salesforce Security - Identifying vulnerabilities

I have completed a review of the following aspects of our organization a) Authentication b) Verifying profile based permissions are inline c) IP restrictions d) Timeout on unattended sessions e) ...
1
vote
3answers
56 views

Not able to update code in packaging code

In a developer org, I created a managed package and released it for security review. The security review was stopped due to few reasons. However, I need to update the package with the new version of ...
1
vote
1answer
35 views

Salesforce: Security Review- Second Organization

A quick question on the security review process, I have everything set up and running on the original developer organization, the publisher portion of it is good. I have no issues outstanding with the ...
0
votes
0answers
31 views

Getting “Lightning: CSS Outside Component” vulnerability in security review

As in salesforce security review report, it's mentioned that we should not use float or position: absolute or fixed. Uses non-standard positioning (via float or position: absolute or fixed) breaks ...
0
votes
0answers
30 views

Where can we get appexchange before payment coupon codes?

I am about to submit my app for security review, in payment page i could see coupon code available. I would like to get one. so where can I get one coupon code ? Also from the security review video ...
0
votes
0answers
15 views

Manage Packages Listing With Dependency?

I am currently building a app to publish in market, done with with my development based on 2gp model, but I am confused on final listing for security review that, Which package needs to be on listing ...
0
votes
0answers
64 views

Getting checkmarx FLS_Create Error in apex

Checkmarx is giving me the FLS_Create error in the below code. cv.PathOnClient = docName; cv.VersionData = requestbody; cv.ContentLocation = 'S'; cv....
0
votes
0answers
31 views

Has anyone used Lightning Out with a managed package?

I am working on an integration with a trading and rebalancing platform for a provider who also uses Salesforce Sales & Service cloud to manage their internal operations. This provider has added ...
0
votes
0answers
53 views

Cross-Site Scripting in visual force input

We have received a security warning regarding Cross-Site Scripting for below input : <apex:inputtext value="{!mergeText}" id="txtField" disabled="true" size="25"/> What changes are required to ...
0
votes
0answers
562 views

HTTP Form Post to external website from Lightning Component

I am working with a client to develop a managed package. Here is the requirement in brief: User clicks a button in a lightning component which is added to Contact detail page. The button click ...
0
votes
1answer
190 views

RichText area field not eliminating XSS issue in checkmarx

I am writing escape=false in my VF Page like this. <apex:outputText escape="false" value="{!cr.Message__c}" rendered="{!(cr.Message__c)!= ''}"/><br/><br/> The Mesage__c is a custom ...
0
votes
0answers
15 views

Safe to create custom object log records in a security-reviewed managed package app?

I want to create a logging system for our AppExchange managed package that will be recorded by Usage Metric features and will also comply with security guidelines to pass the review. To achieve this, ...
0
votes
1answer
35 views

Need help with security review

I have created a package and passed it for security review. The package passed the security review with flying colours!! All this time I installed the package in fresh org and I encountered no ...
0
votes
0answers
338 views

How to make CSS of lightning bundle dynamic

I have a component used in my org from lightning strike. This component uses innerHTML property of element to assign css classes. The code is as follows: Markup: <style aura:id="tooltipStyle"&...
0
votes
1answer
33 views

Adding new look and feel changes to the package for second attempt of security review affect the process?

We got the result for App Exchange security review as "Your App did not pass" with few issues. We have rectified those issue and also done few look and feel (added slds) changes to the Visualforce ...
0
votes
0answers
34 views

List 2 packages from 1 DE Org to Appexchange

I have a developer Org where we are creating an app for Appexchange. We created both Unmanaged and Managed forms of the same app in the Org. My question is whether its possible to get both these ...
0
votes
1answer
53 views

Security review for salesforce to salesforce integration

I'm working on a managed package that we want to publish on the AppExchange. The application has an integration (using a Oauth2) with another salesforce instance. In source instance, i have created a ...
0
votes
1answer
94 views

Scan report for custom REST service for security review. Is that mandatory?

We are about to submit our app for the security review process. I have created two REST resources in Salesforce and they are accessed from SAP system. SAP will send JSON i/p to Salesforce using that ...