Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
1
vote
1answer
28 views

How can I send third party user login information from salesforce to a target API securely?

I am in the thick of creating a salesforce application. I just got my security review back and was rejected because of "Insecure Storage of Sensitive Data". I've read the description of the issue as ...
2
votes
1answer
205 views

Changing Canvas URL in lightning?

I am developing a lightning application that points to a web application using Canvas Frame (IFrame can also be used). Every customer has a specific instance of myApp with a different subdomain. For ...
0
votes
0answers
276 views

How to make CSS of lightning bundle dynamic

I have a component used in my org from lightning strike. This component uses innerHTML property of element to assign css classes. The code is as follows: Markup: <style aura:id="tooltipStyle"&...
11
votes
2answers
357 views

Security Review Preparation: Checking isAccessible on each object and field in complex SOQL queries for whole codebase

We are preparing our managed package for security review. And as a part of this we need to enforce not just create/update/delete but also read (i.e. select) permissions. That means basically checking ...
3
votes
1answer
26 views

Is retrieving data from REST API in Apex consistent with ISV security guidelines?

I'm working on an ISV app that needs to query a large number of records- more than is allowed by the native SOQL query governor limits. If the ISV application calls the Salesforce REST API to retrieve ...
5
votes
1answer
98 views

Salesforce angular security concern

We are using angular for front-end and Salesforce is being used for maintaining database. REST APIs have been written on Salesforce to communicate and fetch data to front-end. SSO OAth settings are ...
2
votes
1answer
97 views

How do you sanitize an Id

I am trying to follow the security guideline which says "parameters of an @AuraEnabled method should not be placed into a SOQL query unsanitized". What is the process to sanitize an Id that is passed ...
3
votes
0answers
84 views

How to generate scan results for the external endpoints to pass salesforce security review?

I have build Salesforce appexchange app and i have used amazon s3 server api to store files in amazon server. I have generated the report for security and quality check but i dont know how to generate ...
1
vote
0answers
23 views

Loading resources dynamically with a link or script tag for google chart allowed?

Our App did not pass the App Exchange security review because of the following issue JS not in Static Resource For jquery and datatables there is a officially accepted source file to load data ...
0
votes
1answer
32 views

Adding new look and feel changes to the package for second attempt of security review affect the process?

We got the result for App Exchange security review as "Your App did not pass" with few issues. We have rectified those issue and also done few look and feel (added slds) changes to the Visualforce ...
1
vote
0answers
86 views

security review: chimera report - Cross-Domain JavaScript Source File Inclusion

I'm preparing for my first security review for an application which has an external web app. I'm looking at the Chimera report and I'm seeing the error: Cross-Domain JavaScript Source File Inclusion. ...
1
vote
1answer
84 views

Error from security review

if(dupObjDel !=null && dupObjDel.size() > 0 ) { if(isSafeObjectDel( dupObjDel ) ) { delete dupObjDel; // ERROR in this line } } public ...
11
votes
2answers
728 views

Sanitizing global string attributes - necessary or not?

Here is a DOM-based XSS flaw reported by SalesForce Security Review team in our code: RootComponent <aura:component extensible="true" abstract="true" access="global" description="...
1
vote
1answer
367 views

isAccessible() vs isQueryable() and which one to use for SOQL query CRUD checks [duplicate]

Whats the difference between isAccessible() vs isQueryable() methods in DescribeSObjectResult Class and which method should one use for CRUD checks in SOQL query ? (https://developer.salesforce.com/...
2
votes
1answer
82 views

Security reviews in Salesforce

A monthly report is being run by our client to check the security of their portal on Salesforce. The report is run using TrustWave. Problem: A threat that report shows is known as Sweet32 or the ...
2
votes
0answers
58 views

CRUD-FLS Implementation for Event Object

We are creating a managed package and have submitted for Security review process. We had implemented CRUD-FLS check on all the objects we had used within our application except EVENT. But we had ...
1
vote
1answer
193 views

Why is the Salesforce security scan saying I don't check isCreateable()?

I am baffled by the Salesforce automated security scan. I just ran it and it says: This query looks for sObject Create operations that are performed without checking for isCreatable(). This may be a ...
1
vote
0answers
104 views

FLS/CRUD Enforcement In Helper Classes

We have several controller classes that call out to helper classes to grab data or save data. This has resulted in a few questions... Is it sufficient to simply check all permissions in the ...
0
votes
0answers
31 views

List 2 packages from 1 DE Org to Appexchange

I have a developer Org where we are creating an app for Appexchange. We created both Unmanaged and Managed forms of the same app in the Org. My question is whether its possible to get both these ...
2
votes
1answer
28 views

Is a usecase document required for security review?

We plan to submit our managed package for security review. We do not have a usecase document for the app. Do we need to provide it for the security review? If yes, do we need to document the basic ...
3
votes
3answers
1k views

App Exchange Lightning ready concept

We are planning to submit our app in app exchange and we are currently in security review step. They have asked us to confirm that our app is lightning ready and asked us few screenshots of the app in ...
1
vote
1answer
125 views

Security review test org for managed package

According to Security Review Test Info, "Starting March 1, 2017 full Locker Compliance will be mandatory to submit for the security review. Therefore, the Developer Edition test environment provided ...
1
vote
1answer
39 views

Changes to managed package while security review is in progress

We are submitting our app for security review but wanted to still continue feature development of our managed package. I had the following questions regarding it: Can we continue development of the ...
3
votes
1answer
53 views

Managed package license timeline

We have a managed package ready to go in for security review . We have yet to fully understand the LMA org and it's functionalities. I wanted to know can we associate licensing for the managed ...
2
votes
1answer
119 views

How do i empty the value in lightning without violating DOM Modification

Component <input onchange="{! c.readCSV}" accept=".csv" type="file" id="file-upload" aura:id="file-upload"/> Controller readCSV : function(component, event, helper){ var file = component....
2
votes
2answers
154 views

Managed package install

I recently realized that we cannot install a managed package beta in a customer environment. We need to provide our package to a customer and that leaves us with an option of converting the managed ...
3
votes
1answer
2k views

Export a CSV using lightning Component without DOM modification

Lightning Controller getData : function(component, file, fileContents) { var action = component.get("c.data"); action.setCallback(this, function(response) { var state = ...
1
vote
1answer
880 views

Difference between Lightning and HTML input tag elements

Case 1 ( works fine) lightning code <lightning:input type="file" label="Mapping" name="Mapping" multiple="false" accept=".csv" onchange="{! c.readCSV }"></lightning:input> after render ...
3
votes
1answer
65 views

Questions regarding appexchange publishing and security review

Is a technical review required before submitting a managed package for security review? Do I need to provide an architecture documentation for the app? If my app changes between the security review ...
4
votes
0answers
118 views

Unable to simulate FLS/CRUD security leaks although no checks in code

I recently checked my managed package using the Force.com Security chechker (by Checkmarx) and the tool listed a few CRUD and FLS issues in my Controller classes. Before fixing them I tried to better ...
1
vote
0answers
420 views

Unable to query PermissionSetAssignment object

I have a method in my package's postInstall script that is trying to check to see if the user has access to edit custom settings. In the method, I query the PermissionSetAssignment object. When I run ...
4
votes
2answers
252 views

Salesforce development and security review lifecycle

I'm a bit confused about the number of orgs needed (and their purpose) for a development and security review process for a managed package. Do I need separate orgs for development and packaging? ...
1
vote
0answers
113 views

FLS Update for id field

In the case of record update, we will use the Id field to specify Id value. How to check FLS for Id field. I have already check isAccesible method. But still, it shows in the security scanner. Is it a ...
1
vote
0answers
141 views

XSS: Best way to encode href for anchor tags

What would be the best way to sanitize a user input for href on anchor tags? I've been looking at this library that is created and approved by Salesforce (SecureFilters) Looking at the different ...
2
votes
1answer
187 views

Enforce FLS/CRUD Delete issue in security scan

I am getting problem in understanding a issue given by security scan. The problem is : [] I am not pasting the whole code but the essential lines: public with sharing class ...
0
votes
1answer
44 views

Security review for salesforce to salesforce integration

I'm working on a managed package that we want to publish on the AppExchange. The application has an integration (using a Oauth2) with another salesforce instance. In source instance, i have created a ...
0
votes
1answer
168 views

CRUD and FLS checks for Batch class , Are they mandatory from security review prospective?

I am working on product and we have lot of Apex Batch Classes developed, I submitted my org code for Checkmarx review and I got lot of security review changes regarding CRUD and FLS check. However I ...
1
vote
1answer
137 views

How to cache CRUD/FLS access checks

In the Connect to Salesforce with Server-Side Controllers module on trailhead, when advising of the requirement to do CRUD/FLS checks, the author cautions: Also, describe calls are expensive. If ...
0
votes
1answer
67 views

Scan report for custom REST service for security review. Is that mandatory?

We are about to submit our app for the security review process. I have created two REST resources in Salesforce and they are accessed from SAP system. SAP will send JSON i/p to Salesforce using that ...
3
votes
0answers
110 views

Burp Scanner-License Issue. Experts suggestions please

We are planning to submit our app in AppExchange. We have succeeded in generating ZAP but we were also asked to submit BURP Scanner report. But the issue with Burp is that, the professional edition ...
0
votes
0answers
46 views

Security Review-Requirements [closed]

We submitted for security review yesterday,and they have sent a mail saying few reports are not being uploaded like ZAP and also few Composite piece(s) of your application was not accessible What ...
2
votes
1answer
93 views

Do we need to submit a Document for Security Review - AppExchange?

From the link Required Testing Information for the ISV Security Review I found a section called Documentation in the above link. Do we need to submit a document described in that section. If the ...
8
votes
2answers
111 views

Security scanner working procedure?

I have submitted my org a week before in Security scanner and it was in queue for a long time. After which I updated our apex codes in the submitted org. So I would like to know whether updated code ...
3
votes
2answers
49 views

Which Org should be submitted for Security Review?

We are planning to List our App in App Exchange.We have already created a developer account with the help of partner portal.We are currently in Security Review Step.Looking at the video it was ...
3
votes
1answer
313 views

CRUD FLS enforcements and best practices

I have written a basic controller class which does insert/delete/update. I wanted to validate whether I'm thinking about CRUD/FLS enforcements the right way. Also wanted to know what are the best ...
2
votes
0answers
160 views

Chimera Token not getting detected in apache

I have uploaded the token, and it is accessible via http://ksinkar.edubrite.us/ChimeraToken.txt But somehow Chimera scanner is not finding it, can you please assist whats wrong here? This is the ...
7
votes
2answers
708 views

What is the main difference between Paid App or Free App on the AppExchange?

I have to put my app on the Salesforce security review process. On the last step it asking for Paid or Free. What will the main difference between Paid and Free App? What extra benefit I get when my ...
0
votes
1answer
31 views

How to cope up with the SAP server maintenance and AppExchange security review?

we are about to submit our app for the security review. The issue would be one of SAP server which we have been using for the app development will be down for maintenance. Since the app relying on the ...
1
vote
0answers
30 views

Security review team for AppExchange will stress test the app? Any thoughts please

We are about to submit an app for the security review. I am wondering whether the security review team will do any stress or performance test on the app? What are they actually do with our code or app?...
4
votes
1answer
1k views

How to resolve FLS Create and FLS Update issue as per security scanner

Running the Security Scanner showed the Following Issues In order to avoid it I tried adding the following line if(Schema.sObjectType.SAP_Change_Event_Config__c.isCreateable())- For object ...