Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
0
votes
2answers
169 views

Lighhtning inline CSS alternatives

The Lightning Component that I built uses a lot of inline CSS. This is because of the configurations for certain clients who wants to give a more personal look and feel of our app. These ...
1
vote
1answer
50 views

What are security review's policy regarding apps that rely heavily on the REST API?

For example, if an app uses the JSforce framework to develop a page that uses AngularJS, could it be blocked because of this? I'm wondering because some parts of the code would have queries and other ...
3
votes
1answer
234 views

Will this approach pass the security review?

Can I pass security review using the next code? I worry about: document.addEventListener('mousemove', drag); document.addEventListener('mouseup', mouseup); and var x = (e.originalEvent && e....
0
votes
1answer
105 views

Security Review and minified external files for Instagram

I've been using oembed, particularly for Instagram (still figuring out how to get Twitter to work), for our Lightning Component to show some Instagram post(s). I've been using the https://platform....
1
vote
1answer
40 views

Security Review expectations on Logout Configuration

Our app did not pass Security Review because "The logout function doesn't perform correctly the removal of session data server-side." Our application uses the popular Devise gem (Ruby on Rails) to ...
0
votes
0answers
26 views

View security review code scanner report

I have published an app on AppExchange and I had to submit zap or burpscan report. However, today I am trying to review that report but I am getting insufficient privileges error. I am not able to ...
0
votes
1answer
409 views

Stored XSS in database.query

We have submitted our code to security review. i'm facing stored xss vulnarabities as described in below lines, please some one help me on this. public map<string,RecordType> RecordTypeMap(...
0
votes
3answers
56 views

Configure settings for managed package that integrates with external web service?

I am sure there is a best-practice way to handle this, but I don't know what it is... The situation is that I am about to submit my Salesforce package for security review. The package works by ...
1
vote
1answer
260 views

Chimera Security Review not finding anti-abuse token for Heroku NodeJs application

I'm trying to review a Nodejs web application as part of an SF app exchange registration - using Chimera. First hurdle is the review keeps coming back unable to verify it's my app. I've uploaded ...
1
vote
1answer
38 views

Error when installing a managed Beta package on a DE Sandbox

The description of a managed beta package reads: "use to test and validate this package internally and with selected customers before release. Note: this type of package can only be installed in ...
8
votes
1answer
579 views

Security Review - CRUD/FLS Checks for every SOQL Query

I know this sounds like a standard question, so please bear with me. Recently our Security Reviews fail due to CRUD/FLS violations. The highlighted codelines include almost every SOQL Query in the ...
2
votes
1answer
39 views

Is doing a getDescribe() on an object subject to FLS security review rules?

Will I get flagged in the security review if I return a list of fields on the Contact object (or Account, Contact, Opporunity) to the user by doing this? schemaMap.get('Contact').getDescribe().fields....
2
votes
1answer
3k views

How to check isAccessible() for a dynamic list of field names?

I have a list of field names in an array: String desiredFieldList; //'AccountId, Id, FirstName ... 'etc String originObjectName; //'Contact', or 'Opportunity' etc queryString = 'SELECT ' + ...
0
votes
2answers
491 views

CRUD/FLS Enforcement in Apex code

I was under the impression that if you declared your classes as: global with sharing class HsignUtils { ... } Then any SOQL you ran in there would be automatically mindful of CRUD/FLS permissions. ...
4
votes
1answer
469 views

How to avoid SOQL/SOSL Injection security review issue?

I am facing following security review issue. I am getting SOQL/SOSL security review issue for the below format of code: String whereclause -> name = 'test'; //assume whereclause entered by user ...
7
votes
3answers
237 views

Security Review Oauth Callback “Insecure Storage of Sensitive Data”

I'm getting dinged in the security review for passing my package namespace prefix back in the state parameter of the OAuth callback. https://login.salesforce.com/services/oauth2/authorize?...
1
vote
0answers
51 views

Security Review without AppExchange listing

We are currently distributing managed packages to our customers without any appexchange listing and hence without paying sales commission to Salesforce. A potential new customer now requires our ...
6
votes
1answer
426 views

Security Review: Illegal DOM Access in Lightning Component

I submitted a lightning component to the Security Review. They reported an issue regarding Illegal DOM Access. I used the following code in my helper and security review team reported it has an issue....
3
votes
1answer
226 views

Salesforce Security Review Field Object (CRUD) and FLS are configured on profiles [closed]

Submitted our package security review few days ago and received the following message from Salesforce Object (CRUD) and Field Level Security (FLS) are configured on profiles and can be used to ...
-1
votes
1answer
36 views

My security review fail because of a unit class : do managed packadge really need to contains unit test class? [closed]

I'm wondering if the managed packadge need to contains all unit test class in the code base use to create de app. I have herited from a code base and managed application and the app is released with ...
9
votes
1answer
145 views

How to hide username and password in log file when using CLI DataLoader?

When using the Dataloader command-line, if the value of parameter sfdc.debugMessages is defined as TRUE then debugging SOAP messages are captured. In the log file generated I can see both the user and ...
1
vote
1answer
1k views

countQuery() returns System.QueryException: unexpected token: ':'

Scenario: While updating some code to satisfy SOQL injection issues brought up by security review report, I stumbled across a code that was not brought up. I thought it was similar to the code in the ...
3
votes
2answers
3k views

How to JSENCODE from an apex controller?

I select a list of sObjects in my controller then pass directly to my visualforce page where I render out as a javascript object. I can't use JSENCODE in the visualforce page because I need the ...
1
vote
1answer
467 views

Alternative to String.escapeSingleQuotes to avoid XSS

I have a few places in my code that were flagged as "Stored XSS" and "Reflected XSS" respectively. Here's an example of a "Stored XSS" vulnerability: Database.query('select Id, Name, Email from ...
2
votes
1answer
617 views

Managed package API URL is different then unmanaged package?

After my app is granted an OAuth token by the user, I take the "url" provided in the OAuth request, and the token, and make a request back to salesforce to store some settings. In my unmanaged ...
2
votes
1answer
842 views

“Client Cross Frame Scripting Attack” flagged by Checkmarx scanner

I have a page where the users can click a link which opens a popup window to start the OAuth connection/flow. However this page is getting flagged by the Checkmarx scanner as a possible "Client Cross ...
3
votes
1answer
1k views

“Multiple Forms In Visualforce Page” caught by Checkmarx scanner

One of my pages was scanned by Checkmarx and it's returning this flag "Multiple Forms In Visualforce Page" Indeed in my page I have several form tags like so: <apex:outputPanel rendered="{! $...
0
votes
1answer
416 views

“Sharing With Controller” Vulnerability

I got a "Sharing with Controller" Vulnerability from the Checkmarx scan. It doesn't give many details though it only flags this line in my Visualforce page: <apex:page controller="...
5
votes
2answers
1k views

How to fix an FLS security vulnerability?

In my managed package I have a custom RestResource that looks something like this (simplified): @RestResource(urlMapping='/customsettings') global class setCustomSettings { CustomSetting__c ...
3
votes
2answers
65 views

Are ISV apps allowed to create unmanaged metadata dynamically?

I'm trying to create a developer tool for the AppExchange that is able to create unmanaged Apex classes dynamically (for example, after clicking a button in the app.) Does salesforce allow ISV apps ...
1
vote
1answer
37 views

How to use the security scanner when you need your code in a package?

I'm creating a package in a Developer Edition and there's a couple reasons why I want to keep all my components (apex code, visualforce pages, etc) in a package. It lets me subscribe to the ...
4
votes
1answer
1k views

Lightning security on init page load with server-side call

I was reading through the Lightning Security documentation here and noticed one of the points for Cross Site Forgery. In order to prevent CSRF attacks, do not invoke any server-side controller ...
1
vote
2answers
200 views

“Instances of SELECT vulnerability found across the application” for CRUD/FLS in Security Review

We received a note from the security review team highlighting a CRUD/FLS vulnerability in our package and in the note it says there is a "Instances of SELECT vulnerability found across the application"...
4
votes
2answers
3k views

Is Jquery search allowed in Lightning component framework for Security Review

In our application we have a use case where we need to search elements using Jquery as following In the controller : var Id = 'groupInput'+component.get("v.comp_suffx"); var GroupInputVal = $("#"+...
3
votes
1answer
116 views

Do canvas applications need to go through security approval?

I've heard mixed things. If I have an app that primarily uses Salesforce Canvas to operate, is that required to go through the security review? Does it perhaps depend on if it's a managed package vs. ...
2
votes
1answer
54 views

What are some common reasons to fail a managed packaged security review?

Just looking for the top few things to watch out for. Can anyone recommend common mistakes or areas of concern?
1
vote
0answers
79 views

Security review with third party integration

I'm working on a managed package that we want to publish on the AppExchange. The application has an integration (using a webservice) with a third party application that is not related to Salesforce in ...
1
vote
1answer
660 views

Use Strict Transport Security (HSTS) with Salesforce

We are having a third party do security testing for our Salesforce community and one of their suggestions was to "utilize the "Strict-Transport-Security" response header across the entire domain as a ...
5
votes
2answers
489 views

How to store sensitive data in Salesforce (for AppExchange package)?

I am developing AppExchange package, it contains integration with third-party webservice. I store credentials to this webservice in custom settings. After security review I received an email with ...
6
votes
1answer
678 views

Are external iframes in lightning experience kosher from a security review perspective?

We are looking to embed an external page in lightning experience. I'm trying to understand if a canvas app or an iframe is the recommended approach from a security review perspective for our use-case. ...
4
votes
1answer
294 views

DOM modification feasibility in lightning

I want to implement Auto Compete in lightning, for this I have to use jQuery and jQueryUI and I have to directly modify DOM of component as well. Will it be allowed by the Salesforce ? Will is cause ...
2
votes
0answers
105 views

Firing event in renderer issue

I am using highcharts in my lightning components which is embedded in a lightning app. When clicking on the chart , I am firing an event. the method to draw the chart is called from renderer. And the ...
2
votes
0answers
113 views

Marketing cloud hubexchange app's security review

I recently hear the news that Salesforce is asking for the security review of hubexchange apps.I'm not sure this is only for security purpose or they are migrating the hubexchange apps to appexchange. ...
3
votes
1answer
103 views

Security Scan for remote site

Can you please help me running scan for a remote site setting. SFDC asked for chimera report for remote Site setting. eg. I have a remote site setting with URL as: https://abc.abc.com and which gets ...
4
votes
1answer
201 views

Stored XSS - Salesforce security check ( AngularJS) error

I am getting an error while security check Category : cross-site scripting , Stored XSS for below $scope.nameMap = {!nameMap}; For javaScript we have some encoding methos but i didn't found such ...
5
votes
2answers
325 views

What is the best way to include AES Encryption private key in a Managed App (with Security Review Passing)?

I'm trying to get an app pass Security Review, but the review team has identified that the key phrase being used is insecure storage mechanism. What I did was, I simply put the key in string ...
8
votes
2answers
621 views

Why is Security Review not passing app because of Weblinks containing JS code?

In latest development Salesforce Security Review team identified an issue with Javascript code in WebLinks. The exact statement that was provided in Security Report was: JavaScript of any type is ...
2
votes
1answer
121 views

Salesforce periodic security review process

I have a Salesforce App which passed security review for the first time in the last year. This App also includes integration with external web application, due to this I also submitted a BURP scan ...
4
votes
1answer
609 views

Error logging in to Chimera and got error. Please suggest

When we tried to logging in Chimera, but got the following error. We want to scan our code before security and technical review process. Please suggest. Problem Logging In We can’t log you in ...
0
votes
1answer
14 views

Change aesthetic things in an app package

Suppose I have an app ready to deploy to the AppExchange. It just passed the Security Review, but I see that there are minor changes like a field's, object's or tab's label/name. Such change could be ...