Questions tagged [security-review]
All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.
363
questions
1
vote
1
answer
235
views
Remove Sample Code references in Managed package metadata
One of our partners reached out to us in helping their package pass security review. The recent report they received contains the following issue:
Sample Code in Production
Account.object
Issue ...
- 10.1k
1
vote
0
answers
43
views
CRUD/FLS Enforcement for configuration tables like FiscalYearSettings
Is Field Level Security enforcement a requirement for querying tables like 'FiscalYearSettings' and 'Period'? or only for tables like Opportunity and Contact.
Our app need to display the fiscal year ...
- 133
1
vote
0
answers
77
views
Building managed package using JS frameworks/library
I'm trying to do an analysis of an existing managed package that we have built currently we have a bunch of VF pages and Lightning Components.
At end of this analysis, we want to determine which JS ...
- 1,291
6
votes
1
answer
1k
views
Why use ESAPI for encoding?
We're working on getting out managed package to pass security review. In various documentation (including trailhead) Salesforce are recommending we use ESAPI for server side (apex) encoding.
My ...
- 6,585
0
votes
2
answers
111
views
What should I do to resolve salesforce security review?
I had run a security review for my apex code. It returned a number of FLS update error in the result. I have changed/implemented code (see below the code snippet) but the error is still there. Please ...
0
votes
1
answer
615
views
Securely storing and retrieving google maps api key for appexchange app
i am planning to use google maps in one of appexchange apps. We need to store and retrieve the api key to be used for google maps.
The end client would have to enter the key that they had signed up ...
- 12.3k
3
votes
2
answers
337
views
Is a component only launched from a quick action safe from CSRF?
I've got a component that is launched from a quick action and on init preforms some DML and redirects the user. It only implements these three interfaces and is not referenced anywhere else in the ...
- 757
1
vote
1
answer
629
views
Can any package can be both managed, and installable in production, without requiring appexchange security review?
Can any package can be both managed, and installable in production without appexchange security review? Assume a beta tester wants to beta the managed app in production.
According to "Beta Versions ...
- 1,110
2
votes
1
answer
2k
views
Risk of CSRF In Lightning Applications
Could a package fail security review due to a lightning application that executes an initialization action on load that creates a record?
e.g. user visits https://[instance].lightning.force.com/c/...
- 757
1
vote
2
answers
575
views
Do we need to check FLS for Record Id field in apex?
We are submitting our application for Security review so we have to check FLS/CURD so we have a query like below.
Account ac = [SELECT id, Name From Account limit 1];
so do we need to check ...
- 1,061
1
vote
2
answers
169
views
Security review issue "Password Echo"
I have submitted to my app to security review, it resulted me "Password Echo" issue. App consists of a protected custom settings to store the username and password. we have implemented UI to insert/...
0
votes
1
answer
409
views
Iframe in manage pacakge
I want to create an appexchange app. In that app, external site page(other system's page) will be shown under salesforce tab. To show external site page in visualforce page/lightning component, i will ...
- 447
4
votes
2
answers
472
views
Usage of let keyword, JS fat arrow & JS functional constructs in Lightning component
Does Salesforce security review reject a package/ lightning component if the following are used in lightning component code?
(a) let keyword, instead of var
(b) JS fat arrow (=>) within the controller/...
- 5,281
0
votes
0
answers
903
views
HTTP Form Post to external website from Lightning Component
I am working with a client to develop a managed package. Here is the requirement in brief:
User clicks a button in a lightning component which is added to Contact detail page.
The button click ...
- 477
1
vote
1
answer
89
views
Enforce Shield encryption, still valid for security review?
Just went through Security Requirements Checklist (https://developer.salesforce.com/page/Requirements_Checklist) in order to verify things that could be detected as a vulnerability in our app for ...
- 941
0
votes
1
answer
434
views
RichText area field not eliminating XSS issue in checkmarx
I am writing escape=false in my VF Page like this.
<apex:outputText escape="false" value="{!cr.Message__c}" rendered="{!(cr.Message__c)!= ''}"/><br/><br/>
The Mesage__c is a custom ...
- 33
1
vote
1
answer
70
views
Security review vs lightning readiness [closed]
We're in the process of submitting the ap through Salesforce Security Review and kind of unsure if Lightning Readiness Report is important to pass the review.
Can someone shed some light on this?
- 23
1
vote
1
answer
459
views
Query: Hardcoding Of Trigger New
I have wrote an trigger which works fine functionality wise but when we send our product for security review it says
Query: Hardcoding Of Trigger New
Below is my trigger
trigger CostTrigger on ...
- 159
2
votes
1
answer
609
views
How much time Salesforce takes to Review a lightning app before uploading that on AppExchange?
I am working on lightning app and want to upload that on AppExchange.
For this, I have followed the process described in Trailhead.
But I am not sure about how much time its takes in review of that ...
- 325
7
votes
2
answers
3k
views
Checkmarx Force.com Security Source Scanner - any way to mark known false-positives?
For the Force.com Security Source Scanner, is there a mechanism of the same nature as eslint-disable-line for inhibiting known false-positive reports? With the false positives excluded, future scans ...
- 136k
1
vote
1
answer
32
views
Does entire application needs to pass through review if we have integration with our external setup
We have integrated our app into salesforce nd it used few of our APIs from saleaforce code.
So in review process, does entire external app needs to be reviewed or only the APIs which were called from ...
- 173
0
votes
0
answers
20
views
Safe to create custom object log records in a security-reviewed managed package app?
I want to create a logging system for our AppExchange managed package that will be recorded by Usage Metric features and will also comply with security guidelines to pass the review.
To achieve this, ...
- 1,737
1
vote
2
answers
355
views
Conditional logic or throwing an exception when checking FLS and object CRUD?
When checking Field-Level Security or object CRUD in Apex within a managed package, is it required to use conditional access to prevent the given operation (for the purposes of passing the security ...
- 1,737
0
votes
1
answer
60
views
Need help with security review
I have created a package and passed it for security review. The package passed the security review with flying colours!! All this time I installed the package in fresh org and I encountered no ...
5
votes
2
answers
9k
views
SOQL Injection Vulnerability
In security scan am getting error as "SOQL Injection Vulnerability" and also the note as "The query is user controllable"
string query = 'SELECT '+ queryFields +' From '+MFNameSpaceUtil.PrependNS('...
- 461
6
votes
1
answer
2k
views
security scan for web application using ZAP, Chimera, or Burp
In my org am using the Twilio web application and cleared the security review using checkmark and when submitted I received an email to verify the Twilio using either chimera or zap.
If your app ...
- 461
3
votes
1
answer
219
views
Tooling API from Visualforce - OK in managed package?
I'm working on a project that will have us create a managed package which can be used for integration between Salesforce and our client's platform (let's just call it Cloud Product). Our client will ...
- 11k
2
votes
1
answer
128
views
Security Review on links to webpages from external application
I am developing an application using a Canvas App. I have an external application that will be displayed in Salesforce using a Canvas Frame.
My external application contains links to external websites ...
- 91
1
vote
1
answer
643
views
Salesforce security review - ID field fls create
In salesforce security review am getting a error FLS create which is for ID field. so when a FLS create error occurred, validated the isCreateable or isUpdatebale for update condtion.
Here how to ...
- 461
4
votes
2
answers
1k
views
How to distribute a Connected App?
I developed a standalone application using REST API to extract Salesforce data using a Connected App. The application uses OAuth 2.0 Web Server Flow to authenticate users. I am following the specified ...
- 91
1
vote
1
answer
121
views
How can I send third party user login information from salesforce to a target API securely?
I am in the thick of creating a salesforce application. I just got my security review back and was rejected because of "Insecure Storage of Sensitive Data". I've read the description of the issue as ...
3
votes
1
answer
592
views
Changing Canvas URL in lightning?
I am developing a lightning application that points to a web application using Canvas Frame (IFrame can also be used). Every customer has a specific instance of myApp with a different subdomain. For ...
- 91
0
votes
0
answers
459
views
How to make CSS of lightning bundle dynamic
I have a component used in my org from lightning strike. This component uses innerHTML property of element to assign css classes. The code is as follows:
Markup:
<style aura:id="tooltipStyle"&...
- 2,580
11
votes
3
answers
1k
views
Security Review Preparation: Checking isAccessible on each object and field in complex SOQL queries for whole codebase
We are preparing our managed package for security review.
And as a part of this we need to enforce not just create/update/delete but also read (i.e. select) permissions. That means basically checking ...
- 3,020
3
votes
1
answer
74
views
Is retrieving data from REST API in Apex consistent with ISV security guidelines?
I'm working on an ISV app that needs to query a large number of records- more than is allowed by the native SOQL query governor limits. If the ISV application calls the Salesforce REST API to retrieve ...
- 1,737
5
votes
1
answer
114
views
Salesforce angular security concern
We are using angular for front-end and Salesforce is being used for maintaining database. REST APIs have been written on Salesforce to communicate and fetch data to front-end. SSO OAth settings are ...
2
votes
1
answer
696
views
How do you sanitize an Id
I am trying to follow the security guideline which says "parameters of an @AuraEnabled method should not be placed into a SOQL query unsanitized". What is the process to sanitize an Id that is passed ...
- 1,596
4
votes
0
answers
196
views
How to generate scan results for the external endpoints to pass salesforce security review?
I have build Salesforce appexchange app and i have used amazon s3 server api to store files in amazon server. I have generated the report for security and quality check but i dont know how to generate ...
- 938
1
vote
0
answers
41
views
Loading resources dynamically with a link or script tag for google chart allowed?
Our App did not pass the App Exchange security review because of the following issue
JS not in Static Resource
For jquery and datatables there is a officially accepted source file to load data ...
- 1,456
0
votes
1
answer
37
views
Adding new look and feel changes to the package for second attempt of security review affect the process?
We got the result for App Exchange security review as "Your App did not pass" with few issues. We have rectified those issue and also done few look and feel (added slds) changes to the Visualforce ...
- 1,456
1
vote
0
answers
204
views
security review: chimera report - Cross-Domain JavaScript Source File Inclusion
I'm preparing for my first security review for an application which has an external web app.
I'm looking at the Chimera report and I'm seeing the error: Cross-Domain JavaScript Source File Inclusion. ...
- 337
1
vote
1
answer
197
views
Error from security review
if(dupObjDel !=null && dupObjDel.size() > 0 ) {
if(isSafeObjectDel( dupObjDel ) ) {
delete dupObjDel; // ERROR in this line
}
}
public ...
- 11
11
votes
2
answers
2k
views
Sanitizing global string attributes - necessary or not?
Here is a DOM-based XSS flaw reported by SalesForce Security Review team in our code:
RootComponent
<aura:component extensible="true" abstract="true" access="global"
description="...
- 3,159
2
votes
1
answer
1k
views
isAccessible() vs isQueryable() and which one to use for SOQL query CRUD checks [duplicate]
Whats the difference between isAccessible() vs isQueryable() methods in DescribeSObjectResult Class and which method should one use for CRUD checks in SOQL query ?
(https://developer.salesforce.com/...
- 51
2
votes
1
answer
108
views
Security reviews in Salesforce
A monthly report is being run by our client to check the security of their portal on Salesforce.
The report is run using TrustWave.
Problem: A threat that report shows is known as Sweet32 or the ...
- 728
2
votes
0
answers
119
views
CRUD-FLS Implementation for Event Object
We are creating a managed package and have submitted for Security review process.
We had implemented CRUD-FLS check on all the objects we had used within our application except EVENT.
But we had ...
2
votes
1
answer
708
views
Why is the Salesforce security scan saying I don't check isCreateable()?
I am baffled by the Salesforce automated security scan. I just ran it and it says:
This query looks for sObject Create operations that are performed without checking for isCreatable(). This may be a ...
- 854
1
vote
0
answers
184
views
FLS/CRUD Enforcement In Helper Classes
We have several controller classes that call out to helper classes to grab data or save data. This has resulted in a few questions...
Is it sufficient to simply check all permissions in the ...
- 163
0
votes
0
answers
37
views
List 2 packages from 1 DE Org to Appexchange
I have a developer Org where we are creating an app for Appexchange. We created both Unmanaged and Managed forms of the same app in the Org. My question is whether its possible to get both these ...
- 125
2
votes
1
answer
41
views
Is a usecase document required for security review?
We plan to submit our managed package for security review. We do not have a usecase document for the app. Do we need to provide it for the security review? If yes, do we need to document the basic ...
- 21