Questions tagged [security-review]
All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.
363
questions
0
votes
2
answers
90
views
Using SOQL Injection to delete data
I know that SOQL injection can be used to query data the user shouldn't see by providing a value like Bob \' OR Name LIKE '%'. But I'm wondering if you could use an input value like Name LIKE '%')'; ...
- 491k
1
vote
1
answer
332
views
Is there any way to set feature parameters for beta versions which did not pass security review?
Is there any way set feature parameters for package beta versions which did not pass security review?
Assuming you are going to release a new version of package which will include feature parameters.
...
- 364
8
votes
0
answers
352
views
Fail Security Review again and again. New process?
I am aware that Salesforce recently changed some rules for Security Review, which makes the life of ISV and PDO partners harder. Here is another one that I am seeing, and ask for some guidance.
In the ...
- 37.7k
4
votes
3
answers
2k
views
Security review sample "False positive document"
We are submitting our app for security review. We have an ASP.Net web application that consumes few Salesforce APIs. The Burp scanner raised few OS, Ruby, Python and PHP injection errors. But we don't ...
- 2,603
-1
votes
1
answer
620
views
What happens when Password setting is updated?
I am trying to improve our Salesforce Org Health Check score.
I have one setting "Password complexity requirement" where current value is "Must include alpha and numeric characters"...
- 3,288
1
vote
2
answers
69
views
What type of product am I submitting for security review?
I am about to submit my Salesforce package (2GP) for security review, and clicking "Start Review" in the Partner Community portal prompts me with a choice:
What type of product are you ...
- 121
1
vote
1
answer
87
views
If you break ancestry, would you have to start security process from scratch?
If you break ancestry, would you have to start security process from scratch?
I know that if you want to create a package from a different dev hub, you would have to restart the security review ...
- 16.7k
0
votes
1
answer
167
views
How to resolve SOQL SOSL Injection security error
I am fairly new to salesforce. I am getting the soql sosl injection error in the below method while doing query. How to resolve this error?
public static Days_Unavailable__c getAvlRecordById(String ...
- 150k
0
votes
1
answer
394
views
How do I submit a 2nd generation managed package for security review?
I am trying to get 2nd generation managed package ready for security review. It is not showing up in the devhub org. How do I submit the package. Do I zip up the source code and submit it?
I have ...
- 92.8k
0
votes
0
answers
49
views
Should I release / promote managed 2nd generation before security review or after security review?
Should I release / promote managed 2nd generation before security review or after security review? I am ready for security review but I am confused if I should use the beta versions that I have been ...
- 121
1
vote
0
answers
157
views
Access to Security Portal (Scanner) when building 2GP
I work as a PDO partner for a customer who wants to have an app on App Exchange. We develop a 2GP package, where Dev Hub is located in the customer PBO, which is linked as an organization to App ...
- 91
0
votes
1
answer
146
views
Is fixing "Apex Code Quality" issues necessary for passing security review?
I have fixed all the "Apex Critical Security Risk" issues but there are few apex code quality issues remaining. Some of them are false positives and some are correct. But due to time ...
- 491k
1
vote
1
answer
162
views
Security Review: Cloud Service uses and stores OAuth tokens
My customer runs a Cloud Service for many years, that connects with Salesforce orgs via OAuth flow and stores org tokens in its database.
As this service wasn't on the AppExchange my customer did not ...
- 91
-1
votes
1
answer
39
views
Which Salesforce scanner tool can I use to scan Chrome Extension(built on Angular utilizing Salesforce APIs)?
We have a Chrome Extension built upon Angular utilizing Salesforce APIs, now We want to publish it on APP Exchange, so we have to upload a scanner report, which scanner tool can we use?
I tried using ...
- 390
3
votes
2
answers
1k
views
SessionID access vulnerability found when using Metadata API
Salesforce is performing manual security review in our package. They have found SessionID access Vulnerability in one of our file where we are using Metadata API to grant permissions on profile and ...
- 3,157
3
votes
1
answer
347
views
Resubmit for Security Review without Patches
I am working for an existing AppExchange ISV Partner that missed the deadlines for Security Review resubmission. When that happens Salesforce is not only taking your Listing down but also deactivating ...
- 37.7k
7
votes
1
answer
326
views
Best (commercial) Scanner to stay prepared for Security Review
For ISVs to be safe to (re)submit their app for Security Review without issues Checkmarx still is the only authoritative tool. But it is also cumbersome and limited as:
Community Scanner is limited ...
- 234
4
votes
1
answer
1k
views
SessionId in LWC for Security Review
I am using this workaround to get the SessionId in my LWC and perform a callout from the JS.
I am concerned about if it will pass the security review for managed packages.
Have someone used it and can ...
- 1,647
1
vote
0
answers
237
views
Run Checkmarx on code not in packaging org (too big for Community scanner)
I am consulting an ISV partner with their resubmission of the Salesforce Security Review.
They ran the initial Checkmarx scan using the Partner Scanner on the code in their Packaging org, then fixed ...
- 37.7k
0
votes
0
answers
26
views
Unable to begin Security Review
I have a lightning App which I have scanned using the Checkmarx app, along with a scan with ZAP. However, when I go to the security review tab, the Start Review button is greyed out and the Update ...
5
votes
4
answers
967
views
How different is Initial Security Review from Resubmission
An ISV customer of mine has a Managed Package in the AppExchange for many years now. He recently was asked to resubmit for Security Review and is now wondering what to expect and how to best plan and ...
- 37.7k
0
votes
1
answer
40
views
SOAP Web API scan for underlying API undder my salesforce app
we are using the web API (SOAP) as a backend in our salesforce app. Do I need to attach the ZAP/Burp or Chimera report with my submit material ? or these reports are only required for WebAppliaction . ...
- 91.2k
0
votes
1
answer
97
views
Code Scanner Portal show error in browser console
I try do security scanner for our code. I use this "Force.com Code Scanner Portal" website to do it. This is the website link: https://security.secure.force.com/security/tools/forcecom/...
- 79
0
votes
1
answer
72
views
security review payment needed every time a different package is submitted?
does every time I submit a package for review the review fee has to be paid? Or is it just once per year?
- 491k
2
votes
0
answers
68
views
Possibility to Install a managed package on production while package is under Security Review
We are working on a managed package, which we are planning to submit for security review in a few weeks.
While the package will be in the security review, we would also like to install the managed ...
- 2,372
0
votes
1
answer
283
views
VfUnescapeEl PMD fix for salesforce static resource page
We are getting VfUnescapeEl error in our sfdx report on the following line :
<a href="{!LEFT($CurrentPage.URL,FIND('/',$CurrentPage.URL,9))}{{x.Id}}">...</a>
here, x.id will be ...
- 36.1k
0
votes
1
answer
500
views
Necessity to resolve all PMD issues for security review
We generated a pmd report using sfdx, is it necessary to resolve all the sfdx report issues to pass the salesforce security review or those are just warnings and can be ignored to pass the security ...
- 36.1k
0
votes
1
answer
110
views
Does Upgrading Major Version Number Trigger Security Review
We're rolling out a larger change in our manage package and it would be nice to recognise these changes by increasing the Major version number on our package. The concern is whether it will trigger a ...
- 362
0
votes
1
answer
408
views
Why newly released package version is not available in Partner Security Portal scanner?
We have released a new minor 2GMP release version and try to check it for Security and Quality rules in Partner Security Portal scanner, but the new version doesn't show up in the picklist for Select ...
- 16.7k
1
vote
1
answer
107
views
Pass SF security review and keep <apex:pageMessages escape="false"/> in a visualforce page
to pass security review we must avoid <apex:pageMessages escape="false"/>
But without the escape="false", my message will not be clickable anymore.
So inside my controller, I ...
- 491k
2
votes
1
answer
129
views
Risks & Benefits of Installing Someone Else's Unlocked 2nd Gen Package
I'm interested in introducing a GitHub project into our enterprise org. That GitHub project currently offers the tool in both Managed Package and Unlocked Package format. The Unlocked Package format ...
- 491k
0
votes
1
answer
86
views
Is it a liability to use the lightning container npm package? (not been updated for 4 years...)
I have embedded my react app in a lightning container iframe as the docs suggest.
<aura:component access="global" implements="flexipage:availableForAllPageTypes">
<...
- 491k
-2
votes
1
answer
632
views
Security Scanner Report in Owasp zap
How to scan my salesforce app in Owasap zap, need to cover everything such as custom objects, flow, process builder, reports and dashboard, etc. at the end need to generate a report, is possible?
- 92.8k
4
votes
1
answer
227
views
Unable to simulate FLS/CRUD security leaks although no checks in code
I recently checked my managed package using the Force.com Security chechker (by Checkmarx) and the tool listed a few CRUD and FLS issues in my Controller classes.
Before fixing them I tried to better ...
- 1,647
2
votes
0
answers
167
views
Information Disclosure Vulnerability
Here is a security vulnerability issue of "Information Disclosure" reported by the Salesforce Team.
URL
https://yourdomain.lightning.force.com/aura?r=13&aura.DynamicComponent....
- 397
4
votes
0
answers
71
views
AppExchange Apps - Security Concerns on embedding URLs with Encrypted Short Lived Access Tokens
We are working on an AppExchange App which integrates with external application at the UI Layer.
External application (composite app) has different widgets which we can embed within AppExchange Aura ...
- 2,372
0
votes
1
answer
201
views
Will the use of apex:actionFunction result in a CSRF vulnerability?
I need the record to be updated when the visualforce page loads. In the apex:page tag, I utilised the action property to invoke the apex method that executes update DML. Salesforce considers an onload ...
- 491k
2
votes
1
answer
327
views
How can I change custom settings field visibility which contains sensitive data to private or protected?
In the process of getting a managed package reviewed and it has been flagged for Insecure Storage of Sensitive Data and highlight the following xml.
<?xml version="1.0" encoding="UTF-...
- 491k
3
votes
1
answer
298
views
Security Review: Lightning: CSS Outside Component
In our SF Security Re-Review report a lightning component was flagged for "Lightning: CSS Outside Component".
The lines they referenced were:
...
<button style="font-size: 20px;top: ...
- 2,907
1
vote
1
answer
3k
views
GET Request with Client ID and Client Secret as Parameter
We are working on an AppExchange app which integrates with 3rd Party application. To connect external app with Salesforce, a Subscriber System admin needs to connect External System using Client Id/...
- 150k
4
votes
2
answers
1k
views
Error logging in to Chimera and got error. Please suggest
When we tried to logging in Chimera, but got the following error. We want to scan our code before security and technical review process. Please suggest.
Problem Logging In
We can’t log you in ...
- 101
1
vote
1
answer
357
views
Checkmarx - Bulkify Apex Methods Using Collections In Methods
Recently I ran a checkmarx scan and saw this issue
Query: Bulkify Apex Methods Using Collections In Methods
I don't understand why checkmarx is showing this issue in few places and not in all methods....
- 303
3
votes
0
answers
169
views
Publishing platform event in doInit of Aura or page load action cause any security vulnerability? [closed]
We have a scenario to publish platform event in doInit of Aura Component (or) action of visualforce page, where in the platform event trigger we're making a dml.
As far as we researched and debugged, ...
2
votes
0
answers
528
views
FLS and CRUD Check for Platform event and Meta Data DML
This might be a silly question, but don't want to get caught under security review.
I have three questions/confirmations related to the security review
FLS/CRUD Check Needed while publishing platform ...
3
votes
1
answer
404
views
Using Window.SessionStorage in product development cause any security vulnerability?
We're storing some encrypted text in the session Window.sessionStorage for community portal, just to avoid multiple server call backs for different navigations.
Will it be flagged under any security ...
- 491k
0
votes
1
answer
720
views
Passing Client Id and Client Secret in URL as Encrypted String for AppExchange App
We are developing an AppExchange application which integrates with external application .Every customer has a connected app because of different branding and different and different callback URLs.
...
- 3,244
3
votes
0
answers
244
views
lightning:container performance/security and why no alternative in LWC [closed]
Is there any specific reason as to why salesforce has not provided the equivalent of lightning:container in LWC ?
Since lightning:container places the component in an iFrame, is it good to use it (in ...
- 485
0
votes
2
answers
604
views
URL Redirection Attack - Source Scanner Results
I have got Query: URL Redirection Attack during Source Scanner.
Piece of controller
@AuraEnabled
public static String forgotPassword(String username, String checkEmailUrl) {
try {
Site....
- 3,244
1
vote
2
answers
638
views
Security review for a managed package with Polymorphic SOQL queries
I checked the documentation "Enable Field- and Object-Level Permissions Checking Using WITH SECURITY_ENFORCED in SOQL Queries". But looks like the below query won't work because traversing a ...
- 91.2k
1
vote
1
answer
434
views
Aura:html tags in component flagged in Security Review
We have received Security review issues for <aura:html tag="style"> used in Lightning component .cmp file.
This was done to change the modal width which is opened from Quick Action.
&...
- 3,244