Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
29
votes
0answers
417 views

Mini Page Layout Hovers in Managed Package

Has anyone using the mini page layout popup technique listed here in a managed package had the package rejected in security review because of it? This is obviously an unsupported technique, but given ...
18
votes
1answer
950 views

How does Salesforce classify an app as 'Salesforce1 ready'?

As part of the Salesforce1 announcement, Salesforce showcased a list of apps on AppExchange that are 'Salesforce1 ready'. This includes several popular apps such as Box, Concur etc. I want to know how ...
16
votes
3answers
2k views

How to pass security review when using “Without sharing” by design?

I failed to pass security review for an app that has two classes using the "without sharing" keyword. Both were not choosen accidentally but by design. On class is SObjectUnitOfWork.cls from Andrew ...
12
votes
2answers
1k views

Rolling back a managed released package?

We have a managed released package currently undergoing security review. While that is happening, we would like to make some changes to the tab layout of our application. Unfortunately, it seems that ...
11
votes
4answers
768 views

How to best enforce CRUD/FLS and pass Security Review in 2019

Since Salesforce began to require CRUD / FLS checks as part of the Security Review for AppEchange apps in 2015 there has been a lot of discussions why this cannot be done by the platform and how this ...
11
votes
2answers
1k views

Sanitizing global string attributes - necessary or not?

Here is a DOM-based XSS flaw reported by SalesForce Security Review team in our code: RootComponent <aura:component extensible="true" abstract="true" access="global" description="...
11
votes
2answers
7k views

How Checkmarx works

Can someone please advise how Checkmarx/ Force.com Security Source Scanner will be performing code review Is code review happening within Salesforce servers or code get ported to Checkmarx server How ...
11
votes
1answer
1k views

BURP Scanning a managed package

Salesforce have asked me to do a BURP Scan on my managed package before I submit it to the AppExchange. My Managed Package is built on the Force.com platform. It does perform a couple of callouts to ...
11
votes
1answer
357 views

Metadata API usage in a managed package

If I have Apex code in my managed package that makes calls to the metadata API of the org in which it is installed to do various things, e.g. describe page layouts, create Visualforce pages based on ...
11
votes
3answers
595 views

Security Review Preparation: Checking isAccessible on each object and field in complex SOQL queries for whole codebase

We are preparing our managed package for security review. And as a part of this we need to enforce not just create/update/delete but also read (i.e. select) permissions. That means basically checking ...
10
votes
2answers
161 views

Incomplete code blocks vulnerability

I've submitted my application for Security Review and I've got this problem in the report. I'm not sure how to fix it. Let's see the First case: I have some classes that don't have any code like ...
9
votes
2answers
605 views

What would really happen in the security review before listing our app in AppExchange?

we have developed an app that we are planning to list it in AppExchange. For that, we have completed AE meeting, first round of technical review with a Saleforce Technical Evangelist. Now, we are ...
9
votes
1answer
871 views

Security Review - CRUD/FLS Checks for every SOQL Query

I know this sounds like a standard question, so please bear with me. Recently our Security Reviews fail due to CRUD/FLS violations. The highlighted codelines include almost every SOQL Query in the ...
9
votes
1answer
1k views

Security Scanner finds XSS False Positives / JSENCODE incompatible with Boolean fields?

Before I submit my app for Security Review I checked it with the free scanner. It marked the following line of JS-code in a Visualforce as Critical XSS vulnerability: <script>var trueOrFalse = '...
9
votes
1answer
182 views

How to hide username and password in log file when using CLI DataLoader?

When using the Dataloader command-line, if the value of parameter sfdc.debugMessages is defined as TRUE then debugging SOAP messages are captured. In the log file generated I can see both the user and ...
9
votes
1answer
3k views

Get a FIRST-CLASS SessionID for API Calls (looking for a clean way or alternative)

I am basically facing the same challenge as @Evan here Different Session Ids in Different contexts I'm also running into SessionID related issues, but in a completely different use case. Background ...
8
votes
4answers
949 views

Genuine SOQL Injection issue or False Positive?

Trying to work out if this a valid issue with my code, or just a false positive I can note in report for Security Review. I have provided a slightly simplified version below. The Id I am querying for ...
8
votes
2answers
123 views

Security scanner working procedure?

I have submitted my org a week before in Security scanner and it was in queue for a long time. After which I updated our apex codes in the submitted org. So I would like to know whether updated code ...
8
votes
2answers
742 views

Why is Security Review not passing app because of Weblinks containing JS code?

In latest development Salesforce Security Review team identified an issue with Javascript code in WebLinks. The exact statement that was provided in Security Report was: JavaScript of any type is ...
7
votes
2answers
1k views

What is the main difference between Paid App or Free App on the AppExchange?

I have to put my app on the Salesforce security review process. On the last step it asking for Paid or Free. What will the main difference between Paid and Free App? What extra benefit I get when my ...
7
votes
3answers
251 views

Security Review Oauth Callback “Insecure Storage of Sensitive Data”

I'm getting dinged in the security review for passing my package namespace prefix back in the state parameter of the OAuth callback. https://login.salesforce.com/services/oauth2/authorize?...
7
votes
4answers
2k views

Cross-Site Request Forgery (CSRF) CWE

I have Following page: <apex:page controller="myclass" action={!clean}> </apex:page> and controller class as: public with sharing class myclass { public void clean() { List<...
7
votes
3answers
1k views

Do we need to check CRUD permissions on custom metadata type/custom setting to pass the AppExchange security review

I have an application that we need to upload on AppExchnage but we need to pass the security review so I have a query on the custom metadata type so do we need to check the isAccessible() permission ...
6
votes
1answer
535 views

Security Review: Illegal DOM Access in Lightning Component

I submitted a lightning component to the Security Review. They reported an issue regarding Illegal DOM Access. I used the following code in my helper and security review team reported it has an issue....
6
votes
2answers
1k views

Checkmarx Force.com Security Source Scanner - any way to mark known false-positives?

For the Force.com Security Source Scanner, is there a mechanism of the same nature as eslint-disable-line for inhibiting known false-positive reports? With the false positives excluded, future scans ...
6
votes
1answer
1k views

security scan for web application using ZAP, Chimera, or Burp

In my org am using the Twilio web application and cleared the security review using checkmark and when submitted I received an email to verify the Twilio using either chimera or zap. If your app ...
6
votes
1answer
2k views

Lightning Components Do NOT Use React?

The combination of Lightning Component and React is NG? Is my understanding of this correct? https://developer.salesforce.com/page/Requirements_Checklist Use of third party MV * frameworks is not ...
6
votes
1answer
518 views

Anyone have examples of genuine security issues identified by the Burp Scanner for external web services called via Apex?

Thanks to this blog post Using the Burp Suite to test a Web Service that is consumed in a Salesforce app I believe I have successfully scanned the two web services that my managed package calls. (This ...
6
votes
1answer
621 views

Direct API Calls from Visualforce Page

I am finding it pretty exciting to make webservice calls directly from visualforce + javascript. Specially with frameworks like Angular, you can directly consume JSON and render HTML templates pretty ...
6
votes
1answer
522 views

Why did I fail Security Review when not checking FLS or using “without sharing”?

I submitted a package for security review which has a Custom Object which has internal / technical semantics only. So it's not created or even seen by users. When a user performs some action some "...
6
votes
1answer
522 views

Why use ESAPI for encoding?

We're working on getting out managed package to pass security review. In various documentation (including trailhead) Salesforce are recommending we use ESAPI for server side (apex) encoding. My ...
6
votes
1answer
888 views

Are external iframes in lightning experience kosher from a security review perspective?

We are looking to embed an external page in lightning experience. I'm trying to understand if a canvas app or an iframe is the recommended approach from a security review perspective for our use-case. ...
6
votes
1answer
1k views

How to set a custom setting value in a managed package securely?

My application uses an authorization key stored in a protected custom setting to authenticate users to connect to an external web service. Since you can't define a default value on package install for ...
5
votes
2answers
2k views

How to fix an FLS security vulnerability?

In my managed package I have a custom RestResource that looks something like this (simplified): @RestResource(urlMapping='/customsettings') global class setCustomSettings { CustomSetting__c ...
5
votes
1answer
3k views

Informational Issues in BURP Scan Report

I tested my app with BURP scan tool.It shows me some informational issues having confidence level of 'Firm' and 'Certain'.It has no Low,Medium and High Issues.So what I want whether is it good enough ...
5
votes
2answers
5k views

How to write comments in APEX classes?

I'm wondering if there is a standard to write comments in APEX ? In order to pass the Security Review, I review my code. And I think writing good comments in APEX classes can help the reviewers to ...
5
votes
1answer
882 views

Security review for free apps in appexchange

We have created one app and planning to list in appexchange as free app. Do we need to pass security review, if yes then is it free or paid?. We have partner developer org to list in Appexchange.
5
votes
2answers
444 views

Security review: After every update?

Do I need to submit my package for security review after every bug fix/version upgrade? My first package was reviewed by security, however I did not make the listing public. Now, my latest package ...
5
votes
2answers
621 views

How to store sensitive data in Salesforce (for AppExchange package)?

I am developing AppExchange package, it contains integration with third-party webservice. I store credentials to this webservice in custom settings. After security review I received an email with ...
5
votes
2answers
427 views

What is the best way to include AES Encryption private key in a Managed App (with Security Review Passing)?

I'm trying to get an app pass Security Review, but the review team has identified that the key phrase being used is insecure storage mechanism. What I did was, I simply put the key in string ...
5
votes
1answer
235 views

Security concerns around site.login() StartURL parameter

I was reading An Insiders Guide to Security Review and on page 17, point 10 noticed something called Unvalidated Redirects and Forwards. The jist here is that user might be redirected to malicious ...
5
votes
1answer
140 views

Is Jest mandatory in LWC For appExchange app

As SF stated Jest is independent of Salesforce and doesn't run in web browser. Is it mandatory to write coverage/unit testing for Lightning Web Components and add in bundle while creating manage ...
5
votes
1answer
666 views

Is it possible to package a Canvas app where the Canvas App URL differs on a per-install basis?

We are currently working creating a managed package which integrates with a third-party service through Canvas. The third-party service has different URLs for different users (similar to how ...
5
votes
1answer
101 views

Salesforce angular security concern

We are using angular for front-end and Salesforce is being used for maintaining database. REST APIs have been written on Salesforce to communicate and fetch data to front-end. SSO OAth settings are ...
5
votes
2answers
2k views

How to resolve FLS Create and FLS Update issue as per security scanner

Running the Security Scanner showed the Following Issues In order to avoid it I tried adding the following line if(Schema.sObjectType.SAP_Change_Event_Config__c.isCreateable())- For object and not ...
5
votes
0answers
26 views

Does lightning beta tags pass security review? [duplicate]

There is lightning:tabset and lightning:tab tags which are still in beta as of now. If we use them while developing an app exchange product do they pass security review? Can we use them in production?
4
votes
2answers
5k views

SOQL Injection Vulnerability

In security scan am getting error as "SOQL Injection Vulnerability" and also the note as "The query is user controllable" string query = 'SELECT '+ queryFields +' From '+MFNameSpaceUtil.PrependNS('...
4
votes
2answers
262 views

Salesforce development and security review lifecycle

I'm a bit confused about the number of orgs needed (and their purpose) for a development and security review process for a managed package. Do I need separate orgs for development and packaging? ...
4
votes
2answers
1k views

Burp Scanner in Salesforce

Salesforce have asked me to do a BURP Scan on my managed package before I submit it to the AppExchange. My Managed Package is built on the Force.com platform. It does perform a couple of callouts to ...
4
votes
3answers
271 views

Second-Generation Managed Package Security Review

Generally, the question stands as what steps need to be done in order to send 2-nd generation managed package for security review. Current conditions: I have developed 2-nd generation managed ...

1
2 3 4 5