Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

50 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
29
votes
0answers
416 views

Mini Page Layout Hovers in Managed Package

Has anyone using the mini page layout popup technique listed here in a managed package had the package rejected in security review because of it? This is obviously an unsupported technique, but given ...
11
votes
3answers
591 views

Security Review Preparation: Checking isAccessible on each object and field in complex SOQL queries for whole codebase

We are preparing our managed package for security review. And as a part of this we need to enforce not just create/update/delete but also read (i.e. select) permissions. That means basically checking ...
4
votes
0answers
75 views

Auth. Providers and Named Credentilas for Salesforce Security Review

We have managed package, where in we are asking users to configure Auth. Providers,Named Credentials after package installation as user might need to change endpoint when user have to connect to ...
4
votes
0answers
152 views

Unable to simulate FLS/CRUD security leaks although no checks in code

I recently checked my managed package using the Force.com Security chechker (by Checkmarx) and the tool listed a few CRUD and FLS issues in my Controller classes. Before fixing them I tried to better ...
4
votes
0answers
379 views

How to Address DOM-based XSS from Security Review

I have a remoting function on my page that takes a list of contacts, and displays them in on Lightning Design styled page. It works fine, but the final innerHTML statement gets flagged in security ...
3
votes
0answers
65 views

Integrate external app using IFrame (not Canvas) and Security review

I have a customer that wants to integrate an external Java App with a Managed Package. As the endpoint (domain name) of the external Java App(s) is not static but differs from customer to customer we ...
3
votes
0answers
108 views

How to generate scan results for the external endpoints to pass salesforce security review?

I have build Salesforce appexchange app and i have used amazon s3 server api to store files in amazon server. I have generated the report for security and quality check but i dont know how to generate ...
3
votes
0answers
115 views

Burp Scanner-License Issue. Experts suggestions please

We are planning to submit our app in AppExchange. We have succeeded in generating ZAP but we were also asked to submit BURP Scanner report. But the issue with Burp is that, the professional edition ...
2
votes
1answer
55 views

Do I need to define sharing for test classes?

The question is simple: should test classes be defined with sharing with sharing | without sharing | inherited sharing to pass the security review? Technically Salesforce enforces this by saying it ...
2
votes
0answers
27 views

How to register an external app in appexchange marketplace

We have an external .net application which connects into SF using API. We want to sell this app on appexchange. What are steps that need to be taken to list it on appexchange? How does the security ...
2
votes
0answers
58 views

Javascript in Static Resources for security review but requires parameter

I have a package that was submitted for security review which requires JS to be in static resources. Required: all script and style resources must be loaded through static resources Do not load ...
2
votes
0answers
64 views

CRUD-FLS Implementation for Event Object

We are creating a managed package and have submitted for Security review process. We had implemented CRUD-FLS check on all the objects we had used within our application except EVENT. But we had ...
2
votes
1answer
143 views

How do i empty the value in lightning without violating DOM Modification

Component <input onchange="{! c.readCSV}" accept=".csv" type="file" id="file-upload" aura:id="file-upload"/> Controller readCSV : function(component, event, helper){ var file = component....
2
votes
1answer
222 views

Enforce FLS/CRUD Delete issue in security scan

I am getting problem in understanding a issue given by security scan. The problem is : [] I am not pasting the whole code but the essential lines: public with sharing class ...
2
votes
0answers
232 views

Chimera Token not getting detected in apache

I have uploaded the token, and it is accessible via http://ksinkar.edubrite.us/ChimeraToken.txt But somehow Chimera scanner is not finding it, can you please assist whats wrong here? This is the ...
2
votes
0answers
98 views

Security review with third party integration

I'm working on a managed package that we want to publish on the AppExchange. The application has an integration (using a webservice) with a third party application that is not related to Salesforce in ...
2
votes
0answers
114 views

Firing event in renderer issue

I am using highcharts in my lightning components which is embedded in a lightning app. When clicking on the chart , I am firing an event. the method to draw the chart is called from renderer. And the ...
2
votes
0answers
128 views

Marketing cloud hubexchange app's security review

I recently hear the news that Salesforce is asking for the security review of hubexchange apps.I'm not sure this is only for security purpose or they are migrating the hubexchange apps to appexchange. ...
2
votes
1answer
184 views

Salesforce Security Review documentation

I want to know if their is any proper documentation format that I have to follow for security review. I have searched for the document format and got this link https://developer.salesforce.com/page/...
1
vote
0answers
32 views

CRUD/FLS Enforcement for configuration tables like FiscalYearSettings

Is Field Level Security enforcement a requirement for querying tables like 'FiscalYearSettings' and 'Period'? or only for tables like Opportunity and Contact. Our app need to display the fiscal year ...
1
vote
0answers
50 views

Building managed package using JS frameworks/library

I'm trying to do an analysis of an existing managed package that we have built currently we have a bunch of VF pages and Lightning Components. At end of this analysis, we want to determine which JS ...
1
vote
0answers
26 views

Loading resources dynamically with a link or script tag for google chart allowed?

Our App did not pass the App Exchange security review because of the following issue JS not in Static Resource For jquery and datatables there is a officially accepted source file to load data ...
1
vote
0answers
113 views

security review: chimera report - Cross-Domain JavaScript Source File Inclusion

I'm preparing for my first security review for an application which has an external web app. I'm looking at the Chimera report and I'm seeing the error: Cross-Domain JavaScript Source File Inclusion. ...
1
vote
0answers
125 views

FLS/CRUD Enforcement In Helper Classes

We have several controller classes that call out to helper classes to grab data or save data. This has resulted in a few questions... Is it sufficient to simply check all permissions in the ...
1
vote
1answer
963 views

Difference between Lightning and HTML input tag elements

Case 1 ( works fine) lightning code <lightning:input type="file" label="Mapping" name="Mapping" multiple="false" accept=".csv" onchange="{! c.readCSV }"></lightning:input> after render ...
1
vote
0answers
579 views

Unable to query PermissionSetAssignment object

I have a method in my package's postInstall script that is trying to check to see if the user has access to edit custom settings. In the method, I query the PermissionSetAssignment object. When I run ...
1
vote
0answers
140 views

FLS Update for id field

In the case of record update, we will use the Id field to specify Id value. How to check FLS for Id field. I have already check isAccesible method. But still, it shows in the security scanner. Is it a ...
1
vote
0answers
178 views

XSS: Best way to encode href for anchor tags

What would be the best way to sanitize a user input for href on anchor tags? I've been looking at this library that is created and approved by Salesforce (SecureFilters) Looking at the different ...
1
vote
0answers
30 views

Security review team for AppExchange will stress test the app? Any thoughts please

We are about to submit an app for the security review. I am wondering whether the security review team will do any stress or performance test on the app? What are they actually do with our code or app?...
1
vote
1answer
58 views

Security Review expectations on Logout Configuration

Our app did not pass Security Review because "The logout function doesn't perform correctly the removal of session data server-side." Our application uses the popular Devise gem (Ruby on Rails) to ...
1
vote
1answer
42 views

Error when installing a managed Beta package on a DE Sandbox

The description of a managed beta package reads: "use to test and validate this package internally and with selected customers before release. Note: this type of package can only be installed in ...
1
vote
0answers
61 views

Security Review without AppExchange listing

We are currently distributing managed packages to our customers without any appexchange listing and hence without paying sales commission to Salesforce. A potential new customer now requires our ...
1
vote
1answer
53 views

Salesforce Security - Identifying vulnerabilities

I have completed a review of the following aspects of our organization a) Authentication b) Verifying profile based permissions are inline c) IP restrictions d) Timeout on unattended sessions e) ...
1
vote
3answers
55 views

Not able to update code in packaging code

In a developer org, I created a managed package and released it for security review. The security review was stopped due to few reasons. However, I need to update the package with the new version of ...
1
vote
1answer
35 views

Salesforce: Security Review- Second Organization

A quick question on the security review process, I have everything set up and running on the original developer organization, the publisher portion of it is good. I have no issues outstanding with the ...
0
votes
0answers
16 views

Has anyone used Lightning Out with a managed package?

I am working on an integration with a trading and rebalancing platform for a provider who also uses Salesforce Sales & Service cloud to manage their internal operations. This provider has added ...
0
votes
0answers
40 views

Cross-Site Scripting in visual force input

We have received a security warning regarding Cross-Site Scripting for below input : <apex:inputtext value="{!mergeText}" id="txtField" disabled="true" size="25"/> What changes are required to ...
0
votes
0answers
513 views

HTTP Form Post to external website from Lightning Component

I am working with a client to develop a managed package. Here is the requirement in brief: User clicks a button in a lightning component which is added to Contact detail page. The button click ...
0
votes
1answer
156 views

RichText area field not eliminating XSS issue in checkmarx

I am writing escape=false in my VF Page like this. <apex:outputText escape="false" value="{!cr.Message__c}" rendered="{!(cr.Message__c)!= ''}"/><br/><br/> The Mesage__c is a custom ...
0
votes
0answers
14 views

Safe to create custom object log records in a security-reviewed managed package app?

I want to create a logging system for our AppExchange managed package that will be recorded by Usage Metric features and will also comply with security guidelines to pass the review. To achieve this, ...
0
votes
1answer
33 views

Need help with security review

I have created a package and passed it for security review. The package passed the security review with flying colours!! All this time I installed the package in fresh org and I encountered no ...
0
votes
0answers
334 views

How to make CSS of lightning bundle dynamic

I have a component used in my org from lightning strike. This component uses innerHTML property of element to assign css classes. The code is as follows: Markup: <style aura:id="tooltipStyle"&...
0
votes
1answer
33 views

Adding new look and feel changes to the package for second attempt of security review affect the process?

We got the result for App Exchange security review as "Your App did not pass" with few issues. We have rectified those issue and also done few look and feel (added slds) changes to the Visualforce ...
0
votes
0answers
33 views

List 2 packages from 1 DE Org to Appexchange

I have a developer Org where we are creating an app for Appexchange. We created both Unmanaged and Managed forms of the same app in the Org. My question is whether its possible to get both these ...
0
votes
1answer
50 views

Security review for salesforce to salesforce integration

I'm working on a managed package that we want to publish on the AppExchange. The application has an integration (using a Oauth2) with another salesforce instance. In source instance, i have created a ...
0
votes
1answer
85 views

Scan report for custom REST service for security review. Is that mandatory?

We are about to submit our app for the security review process. I have created two REST resources in Salesforce and they are accessed from SAP system. SAP will send JSON i/p to Salesforce using that ...
0
votes
1answer
31 views

How to cope up with the SAP server maintenance and AppExchange security review?

we are about to submit our app for the security review. The issue would be one of SAP server which we have been using for the app development will be down for maintenance. Since the app relying on the ...
0
votes
0answers
27 views

View security review code scanner report

I have published an app on AppExchange and I had to submit zap or burpscan report. However, today I am trying to review that report but I am getting insufficient privileges error. I am not able to ...
0
votes
1answer
69 views

Submit app for Review

I want to publish my app on appexchange in order to do so i need to review, So while submitting my for review i am getting error at step 5. salesforce is asking for production/sandbox credentials. I ...
0
votes
1answer
258 views

Force.com Security Scanner Results - Frame Spoofing for Survey force application

I am trying to include survey force application with our existing app and creating a manage package. After submitting the code for Force.com Security review I have received below error messages: ...