Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
4
votes
2answers
439 views

SalesForce Package Distribution Scenarios

I am writing an adapter for SalesForce which functionality will be to post information about particular events happened in the CRM to the external WebService. While I think I understood development ...
4
votes
1answer
170 views

Will an app where all the Apex is “without sharing” pass a Salesforce Security Review?

We are working on a portal app that will run inside a Community and the limited sharing rule capabilities of the lowest priced Communities licenses is making life difficult, particularly as this app ...
4
votes
1answer
237 views

Apex Source Scanner flag CRUD/ FLS as security risk for no reason

I've been using FFLIB_SecurityUtils lib to enforce CRUD and FLS in my apex classes. I've no issues when running unit tests, but when submitting my code on Source Scanner for partners, i've several ...
4
votes
2answers
312 views

Usage of let keyword, JS fat arrow & JS functional constructs in Lightning component

Does Salesforce security review reject a package/ lightning component if the following are used in lightning component code? (a) let keyword, instead of var (b) JS fat arrow (=>) within the controller/...
4
votes
1answer
2k views

Lightning security on init page load with server-side call

I was reading through the Lightning Security documentation here and noticed one of the points for Cross Site Forgery. In order to prevent CSRF attacks, do not invoke any server-side controller method ...
4
votes
2answers
1k views

XSS : Rich textarea content security review issue when using escape=false

I am getting user input through textarea as richtext and storing in object : <div class="col-md-12"> <div class="col-md-12"> <div class="form-group"> <...
4
votes
2answers
333 views

Is data transfer between Salesforce and Heroku secure?

I wanted to check how secure is data transfer between salesforce and heroku. Is there any encryption mechanism built in when we integrate salesforce and Heroku (when data transfer occurs). Update - ...
4
votes
2answers
6k views

How to prevent caching in Cache.db-wal file in iOS App which contain Salesforce iOS SDK

My iOS App rejected by Salesforce security review team with following reason. "Insecure Storage of Sensitive Data" and show this file path /private/var/mobile/Applications/96998CD5-5C0F-490C-8E2C-...
4
votes
1answer
817 views

How to avoid SOQL/SOSL Injection security review issue?

I am facing following security review issue. I am getting SOQL/SOSL security review issue for the below format of code: String whereclause -> name = 'test'; //assume whereclause entered by user ...
4
votes
1answer
313 views

DOM modification feasibility in lightning

I want to implement Auto Compete in lightning, for this I have to use jQuery and jQueryUI and I have to directly modify DOM of component as well. Will it be allowed by the Salesforce ? Will is cause ...
4
votes
1answer
433 views

“inputText_Ignoring_FLS” in force security scanner report

I scan my code, and I received a Serious issue: <apex:inputText value="{!ld.Name}" /> I have applied FLS as the guide here : http://wiki.developerforce.com/page/Enforcing_CRUD_and_FLS <...
4
votes
1answer
1k views

“Multiple Forms In Visualforce Page” caught by Checkmarx scanner

One of my pages was scanned by Checkmarx and it's returning this flag "Multiple Forms In Visualforce Page" Indeed in my page I have several form tags like so: <apex:outputPanel rendered="{! $...
4
votes
2answers
3k views

Is Jquery search allowed in Lightning component framework for Security Review

In our application we have a use case where we need to search elements using Jquery as following In the controller : var Id = 'groupInput'+component.get("v.comp_suffx"); var GroupInputVal = $("#"+...
4
votes
1answer
234 views

Stored XSS - Salesforce security check ( AngularJS) error

I am getting an error while security check Category : cross-site scripting , Stored XSS for below $scope.nameMap = {!nameMap}; For javaScript we have some encoding methos but i didn't found such ...
4
votes
1answer
1k views

Security Review - False Positive Document

I want to submit my app for security review. Since my App is calling some external API security review wizard is prompting to provide below details. Burp Scan report False positive document I have ...
4
votes
1answer
721 views

Error logging in to Chimera and got error. Please suggest

When we tried to logging in Chimera, but got the following error. We want to scan our code before security and technical review process. Please suggest. Problem Logging In We can’t log you in ...
4
votes
2answers
2k views

Managed app installation on Salesforce Production Org

Salesforce has two versions of Managed app Managed App ( Beta ) Managed App ( Released ) Currently inorder to do a prototype testing I released a Managed App (Beta) and simulated how a real ...
4
votes
1answer
122 views

Security Scan/Report for iOS SFDC Product Review

I'm in the process of submitting an iOS application for a Salesforce security review. I'm having trouble figuring out what kinds of security scans/reports they're expecting for an iOS application. ...
4
votes
0answers
81 views

Auth. Providers and Named Credentilas for Salesforce Security Review

We have managed package, where in we are asking users to configure Auth. Providers,Named Credentials after package installation as user might need to change endpoint when user have to connect to ...
4
votes
0answers
51 views

Force.com Site and custom user authorization - Is it allowed and when? [duplicate]

Assume I am going to build a customer facing website where users have some access to Salesforce Standard and custom objects. Because it's expensive I don't want to give them Salesforce licenses. I ...
4
votes
0answers
156 views

Unable to simulate FLS/CRUD security leaks although no checks in code

I recently checked my managed package using the Force.com Security chechker (by Checkmarx) and the tool listed a few CRUD and FLS issues in my Controller classes. Before fixing them I tried to better ...
4
votes
0answers
389 views

How to Address DOM-based XSS from Security Review

I have a remoting function on my page that takes a list of contacts, and displays them in on Lightning Design styled page. It works fine, but the final innerHTML statement gets flagged in security ...
3
votes
2answers
5k views

How to JSENCODE from an apex controller?

I select a list of sObjects in my controller then pass directly to my visualforce page where I render out as a javascript object. I can't use JSENCODE in the visualforce page because I need the ...
3
votes
2answers
403 views

How to OWASP ZAP scan external REST API using OAuth2

I have built a Managed Package that talks to an external REST API using OAuth2 Named Credentials. I now want to submit this app for Security Review. I can't use the Chimera Scanner as it would require ...
3
votes
3answers
204 views

Public Salesforce Site and Security Review

Let's face it. Salesforce Communities is expensive and not for everyone out there. I have a customer who wants to create a customer-facing site where non-logged in users can register themselves and ...
3
votes
1answer
273 views

Salesforce Security Review Field Object (CRUD) and FLS are configured on profiles [closed]

Submitted our package security review few days ago and received the following message from Salesforce Object (CRUD) and Field Level Security (FLS) are configured on profiles and can be used to ...
3
votes
2answers
830 views

XSRF issue in security review..?

I am getting these from URL..when i submitted my app for security review. their report has XSRF error can some help me how to correct this...as i need to oid from the url.i could find any ...
3
votes
1answer
31 views

Is retrieving data from REST API in Apex consistent with ISV security guidelines?

I'm working on an ISV app that needs to query a large number of records- more than is allowed by the native SOQL query governor limits. If the ISV application calls the Salesforce REST API to retrieve ...
3
votes
1answer
8k views

How do I fix Stored XSS and Reflected XSS?

When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and ...
3
votes
2answers
118 views

Do I need to define sharing for inner classes?

In preparation to Security Review I am checking that all my classes follow instructions from Sharing in Apex Classes. Now I am wondering do inner classes also need to be defined as with sharing | ...
3
votes
1answer
113 views

Tooling API from Visualforce - OK in managed package?

I'm working on a project that will have us create a managed package which can be used for integration between Salesforce and our client's platform (let's just call it Cloud Product). Our client will ...
3
votes
2answers
74 views

Are ISV apps allowed to create unmanaged metadata dynamically?

I'm trying to create a developer tool for the AppExchange that is able to create unmanaged Apex classes dynamically (for example, after clicking a button in the app.) Does salesforce allow ISV apps ...
3
votes
2answers
441 views

Security review for paid apps in appexchange

I want send my app to security review of appExchange. Is the Burp Report Compulsory? Thanks in advance
3
votes
2answers
213 views

Is a component only launched from a quick action safe from CSRF?

I've got a component that is launched from a quick action and on init preforms some DML and redirects the user. It only implements these three interfaces and is not referenced anywhere else in the ...
3
votes
3answers
1k views

App Exchange Lightning ready concept

We are planning to submit our app in app exchange and we are currently in security review step. They have asked us to confirm that our app is lightning ready and asked us few screenshots of the app in ...
3
votes
1answer
259 views

Will this approach pass the security review?

Can I pass security review using the next code? I worry about: document.addEventListener('mousemove', drag); document.addEventListener('mouseup', mouseup); and var x = (e.originalEvent && e....
3
votes
1answer
2k views

CRUD permission check Security Review with SOQL queries needed?

The CRUD permission check for Security Review has been imposed recently, though I'm clear on the DML statement and Create/Update/Delete permissions I need to check for in my code, but I'm not clear ...
3
votes
2answers
639 views

How to manage packages and extension packages

I want to deploy an application on the AppExchange and I need some explanations. My application contains several editions (Edition 1, 2, 3 and 4) with differents features. Superior edition contains ...
3
votes
1answer
2k views

Export a CSV using lightning Component without DOM modification

Lightning Controller getData : function(component, file, fileContents) { var action = component.get("c.data"); action.setCallback(this, function(response) { var state = ...
3
votes
2answers
877 views

Security review sample “False positive document”

We are submitting our app for security review. We have an ASP.Net web application that consumes few Salesforce APIs. The Burp scanner raised few OS, Ruby, Python and PHP injection errors. But we don't ...
3
votes
2answers
973 views

CRUD and FLS enforcement

I have an Account list and I want to update it. I want to testing object and field level security enforcement but I'm wondering what I have to test : 1 - if Account object is updatable ? (if it's ...
3
votes
2answers
1k views

How do I fix this Stored XSS?

The CheckMarx security scanner says that this line is a Stored XSS vulnerability <apex:column style="background-color:#{!trade.bgcolor};color:{!trade.fgcolor};"> is this HTMLENCODE the correct ...
3
votes
1answer
286 views

Free App for Paid Service

I'm working on getting an app listed on the AppExchange, and we are just about ready to go into the Security Review. We were wondering if it is going to be a problem that we sell our app for free on ...
3
votes
1answer
2k views

Cross-site Scripting (XSS) in security review.?

I am getting Cross-site Scripting (XSS) while scanning in force.com scanner.if i remove javascript there is no error..what to change in javascript code..please help its quite urgent...may be encode ...
3
votes
1answer
801 views

Drag & Drop Upload Images to documents - Security Problems

We have developed a Drag & Drop multiple Image Upload with Html5, jQuery and the REST API. We are wondering what are the problems that this feature can bring up in the security review. Let me ...
3
votes
1answer
120 views

Endless loop of Chimera scans with failure

Today I started a Chimera scan from https://security.secure.force.com/sourcescanner/chimera__chimera_portal to scan an external API we use in an ISV app which is going into Security Review soon. ...
3
votes
2answers
60 views

Which Org should be submitted for Security Review?

We are planning to List our App in App Exchange.We have already created a developer account with the help of partner portal.We are currently in Security Review Step.Looking at the video it was ...
3
votes
1answer
367 views

CRUD FLS enforcements and best practices

I have written a basic controller class which does insert/delete/update. I wanted to validate whether I'm thinking about CRUD/FLS enforcements the right way. Also wanted to know what are the best ...
3
votes
1answer
138 views

Do canvas applications need to go through security approval?

I've heard mixed things. If I have an app that primarily uses Salesforce Canvas to operate, is that required to go through the security review? Does it perhaps depend on if it's a managed package vs. ...
3
votes
1answer
125 views

Security Scan for remote site

Can you please help me running scan for a remote site setting. SFDC asked for chimera report for remote Site setting. eg. I have a remote site setting with URL as: https://abc.abc.com and which gets ...