Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
0
votes
1answer
31 views

How to cope up with the SAP server maintenance and AppExchange security review?

we are about to submit our app for the security review. The issue would be one of SAP server which we have been using for the app development will be down for maintenance. Since the app relying on the ...
1
vote
0answers
30 views

Security review team for AppExchange will stress test the app? Any thoughts please

We are about to submit an app for the security review. I am wondering whether the security review team will do any stress or performance test on the app? What are they actually do with our code or app?...
4
votes
1answer
1k views

How to resolve FLS Create and FLS Update issue as per security scanner

Running the Security Scanner showed the Following Issues In order to avoid it I tried adding the following line if(Schema.sObjectType.SAP_Change_Event_Config__c.isCreateable())- For object ...
0
votes
2answers
186 views

Lighhtning inline CSS alternatives

The Lightning Component that I built uses a lot of inline CSS. This is because of the configurations for certain clients who wants to give a more personal look and feel of our app. These ...
1
vote
1answer
50 views

What are security review's policy regarding apps that rely heavily on the REST API?

For example, if an app uses the JSforce framework to develop a page that uses AngularJS, could it be blocked because of this? I'm wondering because some parts of the code would have queries and other ...
3
votes
1answer
237 views

Will this approach pass the security review?

Can I pass security review using the next code? I worry about: document.addEventListener('mousemove', drag); document.addEventListener('mouseup', mouseup); and var x = (e.originalEvent && e....
0
votes
1answer
106 views

Security Review and minified external files for Instagram

I've been using oembed, particularly for Instagram (still figuring out how to get Twitter to work), for our Lightning Component to show some Instagram post(s). I've been using the https://platform....
1
vote
1answer
42 views

Security Review expectations on Logout Configuration

Our app did not pass Security Review because "The logout function doesn't perform correctly the removal of session data server-side." Our application uses the popular Devise gem (Ruby on Rails) to ...
0
votes
0answers
26 views

View security review code scanner report

I have published an app on AppExchange and I had to submit zap or burpscan report. However, today I am trying to review that report but I am getting insufficient privileges error. I am not able to ...
0
votes
1answer
430 views

Stored XSS in database.query

We have submitted our code to security review. i'm facing stored xss vulnarabities as described in below lines, please some one help me on this. public map<string,RecordType> RecordTypeMap(...
0
votes
3answers
56 views

Configure settings for managed package that integrates with external web service?

I am sure there is a best-practice way to handle this, but I don't know what it is... The situation is that I am about to submit my Salesforce package for security review. The package works by ...
2
votes
1answer
296 views

Chimera Security Review not finding anti-abuse token for Heroku NodeJs application

I'm trying to review a Nodejs web application as part of an SF app exchange registration - using Chimera. First hurdle is the review keeps coming back unable to verify it's my app. I've uploaded ...
1
vote
1answer
38 views

Error when installing a managed Beta package on a DE Sandbox

The description of a managed beta package reads: "use to test and validate this package internally and with selected customers before release. Note: this type of package can only be installed in ...
9
votes
1answer
656 views

Security Review - CRUD/FLS Checks for every SOQL Query

I know this sounds like a standard question, so please bear with me. Recently our Security Reviews fail due to CRUD/FLS violations. The highlighted codelines include almost every SOQL Query in the ...
2
votes
1answer
39 views

Is doing a getDescribe() on an object subject to FLS security review rules?

Will I get flagged in the security review if I return a list of fields on the Contact object (or Account, Contact, Opporunity) to the user by doing this? schemaMap.get('Contact').getDescribe().fields....
2
votes
1answer
3k views

How to check isAccessible() for a dynamic list of field names?

I have a list of field names in an array: String desiredFieldList; //'AccountId, Id, FirstName ... 'etc String originObjectName; //'Contact', or 'Opportunity' etc queryString = 'SELECT ' + ...
0
votes
2answers
513 views

CRUD/FLS Enforcement in Apex code

I was under the impression that if you declared your classes as: global with sharing class HsignUtils { ... } Then any SOQL you ran in there would be automatically mindful of CRUD/FLS permissions. ...
4
votes
1answer
522 views

How to avoid SOQL/SOSL Injection security review issue?

I am facing following security review issue. I am getting SOQL/SOSL security review issue for the below format of code: String whereclause -> name = 'test'; //assume whereclause entered by user ...
7
votes
3answers
242 views

Security Review Oauth Callback “Insecure Storage of Sensitive Data”

I'm getting dinged in the security review for passing my package namespace prefix back in the state parameter of the OAuth callback. https://login.salesforce.com/services/oauth2/authorize?...
1
vote
0answers
55 views

Security Review without AppExchange listing

We are currently distributing managed packages to our customers without any appexchange listing and hence without paying sales commission to Salesforce. A potential new customer now requires our ...
6
votes
1answer
447 views

Security Review: Illegal DOM Access in Lightning Component

I submitted a lightning component to the Security Review. They reported an issue regarding Illegal DOM Access. I used the following code in my helper and security review team reported it has an issue....
3
votes
1answer
239 views

Salesforce Security Review Field Object (CRUD) and FLS are configured on profiles [closed]

Submitted our package security review few days ago and received the following message from Salesforce Object (CRUD) and Field Level Security (FLS) are configured on profiles and can be used to ...
-1
votes
1answer
37 views

My security review fail because of a unit class : do managed packadge really need to contains unit test class? [closed]

I'm wondering if the managed packadge need to contains all unit test class in the code base use to create de app. I have herited from a code base and managed application and the app is released with ...
9
votes
1answer
150 views

How to hide username and password in log file when using CLI DataLoader?

When using the Dataloader command-line, if the value of parameter sfdc.debugMessages is defined as TRUE then debugging SOAP messages are captured. In the log file generated I can see both the user and ...
1
vote
1answer
1k views

countQuery() returns System.QueryException: unexpected token: ':'

Scenario: While updating some code to satisfy SOQL injection issues brought up by security review report, I stumbled across a code that was not brought up. I thought it was similar to the code in the ...
3
votes
2answers
4k views

How to JSENCODE from an apex controller?

I select a list of sObjects in my controller then pass directly to my visualforce page where I render out as a javascript object. I can't use JSENCODE in the visualforce page because I need the ...
1
vote
1answer
508 views

Alternative to String.escapeSingleQuotes to avoid XSS

I have a few places in my code that were flagged as "Stored XSS" and "Reflected XSS" respectively. Here's an example of a "Stored XSS" vulnerability: Database.query('select Id, Name, Email from ...
2
votes
1answer
658 views

Managed package API URL is different then unmanaged package?

After my app is granted an OAuth token by the user, I take the "url" provided in the OAuth request, and the token, and make a request back to salesforce to store some settings. In my unmanaged ...
2
votes
1answer
849 views

“Client Cross Frame Scripting Attack” flagged by Checkmarx scanner

I have a page where the users can click a link which opens a popup window to start the OAuth connection/flow. However this page is getting flagged by the Checkmarx scanner as a possible "Client Cross ...
4
votes
1answer
1k views

“Multiple Forms In Visualforce Page” caught by Checkmarx scanner

One of my pages was scanned by Checkmarx and it's returning this flag "Multiple Forms In Visualforce Page" Indeed in my page I have several form tags like so: <apex:outputPanel rendered="{! $...
0
votes
1answer
455 views

“Sharing With Controller” Vulnerability

I got a "Sharing with Controller" Vulnerability from the Checkmarx scan. It doesn't give many details though it only flags this line in my Visualforce page: <apex:page controller="...
5
votes
2answers
1k views

How to fix an FLS security vulnerability?

In my managed package I have a custom RestResource that looks something like this (simplified): @RestResource(urlMapping='/customsettings') global class setCustomSettings { CustomSetting__c ...
3
votes
2answers
67 views

Are ISV apps allowed to create unmanaged metadata dynamically?

I'm trying to create a developer tool for the AppExchange that is able to create unmanaged Apex classes dynamically (for example, after clicking a button in the app.) Does salesforce allow ISV apps ...
1
vote
1answer
39 views

How to use the security scanner when you need your code in a package?

I'm creating a package in a Developer Edition and there's a couple reasons why I want to keep all my components (apex code, visualforce pages, etc) in a package. It lets me subscribe to the ...
4
votes
1answer
1k views

Lightning security on init page load with server-side call

I was reading through the Lightning Security documentation here and noticed one of the points for Cross Site Forgery. In order to prevent CSRF attacks, do not invoke any server-side controller ...
1
vote
2answers
207 views

“Instances of SELECT vulnerability found across the application” for CRUD/FLS in Security Review

We received a note from the security review team highlighting a CRUD/FLS vulnerability in our package and in the note it says there is a "Instances of SELECT vulnerability found across the application"...
4
votes
2answers
3k views

Is Jquery search allowed in Lightning component framework for Security Review

In our application we have a use case where we need to search elements using Jquery as following In the controller : var Id = 'groupInput'+component.get("v.comp_suffx"); var GroupInputVal = $("#"+...
3
votes
1answer
123 views

Do canvas applications need to go through security approval?

I've heard mixed things. If I have an app that primarily uses Salesforce Canvas to operate, is that required to go through the security review? Does it perhaps depend on if it's a managed package vs. ...
2
votes
1answer
55 views

What are some common reasons to fail a managed packaged security review?

Just looking for the top few things to watch out for. Can anyone recommend common mistakes or areas of concern?
2
votes
0answers
88 views

Security review with third party integration

I'm working on a managed package that we want to publish on the AppExchange. The application has an integration (using a webservice) with a third party application that is not related to Salesforce in ...
1
vote
1answer
737 views

Use Strict Transport Security (HSTS) with Salesforce

We are having a third party do security testing for our Salesforce community and one of their suggestions was to "utilize the "Strict-Transport-Security" response header across the entire domain as a ...
5
votes
2answers
525 views

How to store sensitive data in Salesforce (for AppExchange package)?

I am developing AppExchange package, it contains integration with third-party webservice. I store credentials to this webservice in custom settings. After security review I received an email with ...
6
votes
1answer
717 views

Are external iframes in lightning experience kosher from a security review perspective?

We are looking to embed an external page in lightning experience. I'm trying to understand if a canvas app or an iframe is the recommended approach from a security review perspective for our use-case. ...
4
votes
1answer
301 views

DOM modification feasibility in lightning

I want to implement Auto Compete in lightning, for this I have to use jQuery and jQueryUI and I have to directly modify DOM of component as well. Will it be allowed by the Salesforce ? Will is cause ...
2
votes
0answers
107 views

Firing event in renderer issue

I am using highcharts in my lightning components which is embedded in a lightning app. When clicking on the chart , I am firing an event. the method to draw the chart is called from renderer. And the ...
2
votes
0answers
117 views

Marketing cloud hubexchange app's security review

I recently hear the news that Salesforce is asking for the security review of hubexchange apps.I'm not sure this is only for security purpose or they are migrating the hubexchange apps to appexchange. ...
3
votes
1answer
107 views

Security Scan for remote site

Can you please help me running scan for a remote site setting. SFDC asked for chimera report for remote Site setting. eg. I have a remote site setting with URL as: https://abc.abc.com and which gets ...
4
votes
1answer
204 views

Stored XSS - Salesforce security check ( AngularJS) error

I am getting an error while security check Category : cross-site scripting , Stored XSS for below $scope.nameMap = {!nameMap}; For javaScript we have some encoding methos but i didn't found such ...
5
votes
2answers
347 views

What is the best way to include AES Encryption private key in a Managed App (with Security Review Passing)?

I'm trying to get an app pass Security Review, but the review team has identified that the key phrase being used is insecure storage mechanism. What I did was, I simply put the key in string ...
8
votes
2answers
651 views

Why is Security Review not passing app because of Weblinks containing JS code?

In latest development Salesforce Security Review team identified an issue with Javascript code in WebLinks. The exact statement that was provided in Security Report was: JavaScript of any type is ...