Questions tagged [security-review]
All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.
363
questions
1
vote
2
answers
342
views
"Instances of SELECT vulnerability found across the application" for CRUD/FLS in Security Review
We received a note from the security review team highlighting a CRUD/FLS vulnerability in our package and in the note it says there is a "Instances of SELECT vulnerability found across the application"...
- 2,212
1
vote
2
answers
249
views
Cloud security scanner issues?
I submitted a scan yesterday : http://security.force.com/security/tools/forcecom/scanner
Normally, I get an email informing me that the scan is put in the queue and then another mail to give me the ...
- 3,616
1
vote
2
answers
8k
views
How do I fix this Reflected XSS vulnerability?
The CheckMarx security scanner says that this line is a Reflected XSS vulnerability.
<apex:outputText value="0,number,#,##0.00}" style="color:!nost.balColor};">
However this page
http://www....
- 735
1
vote
1
answer
236
views
LWC: Click-jacking due to CSS Vulnerability
we received an issue in our salesforce security report "LWC: Click-jacking due to CSS Vulnerability". It list out CSS files where this issue is reported but no more info is provided for this....
- 3,516
1
vote
1
answer
246
views
Do I need to enforce security rules for SOQL in test methods?
I'm currently in the process of updating a managed package for security review. I've been adding the "WITH SECURITY_ENFORCED" statement to SOQL requests, however I've struggled to find any ...
- 41
1
vote
1
answer
476
views
AppExchange Security Review Requiring Fee Submission for FREE Listing Solution
Hope you are having a great day.
We have developed an AppExchange solution to be listed. The solution's pricing model is set to free and the listing is submitted for approval. I have completed ...
1
vote
1
answer
88
views
If you break ancestry, would you have to start security process from scratch?
If you break ancestry, would you have to start security process from scratch?
I know that if you want to create a package from a different dev hub, you would have to restart the security review ...
- 16.7k
1
vote
1
answer
3k
views
GET Request with Client ID and Client Secret as Parameter
We are working on an AppExchange app which integrates with 3rd Party application. To connect external app with Salesforce, a Subscriber System admin needs to connect External System using Client Id/...
- 2,279
1
vote
2
answers
638
views
Security review for a managed package with Polymorphic SOQL queries
I checked the documentation "Enable Field- and Object-Level Permissions Checking Using WITH SECURITY_ENFORCED in SOQL Queries". But looks like the below query won't work because traversing a ...
- 1,400
1
vote
1
answer
132
views
Force.com Source Scanner Results: FLS Update and Create
I've run the Force.com Source Scanner against my Managed Package and here are the summary results:
There are two areas FLS Update and FLS Create where I got 28, and 37 risks respectively...
I am ...
- 9,336
1
vote
1
answer
267
views
Managed Package - Protected Custom Setting for storing creds - Security review
I have created a managed package where I used a protected Custom Setting of hierarchy type to store some user credentials.
I am concerned about security review of the app. Is there any chances of ...
1
vote
1
answer
629
views
Can any package can be both managed, and installable in production, without requiring appexchange security review?
Can any package can be both managed, and installable in production without appexchange security review? Assume a beta tester wants to beta the managed app in production.
According to "Beta Versions ...
- 1,110
1
vote
1
answer
32
views
Does entire application needs to pass through review if we have integration with our external setup
We have integrated our app into salesforce nd it used few of our APIs from saleaforce code.
So in review process, does entire external app needs to be reviewed or only the APIs which were called from ...
- 173
1
vote
1
answer
257
views
Already released Managed Package to AppExchange
I'm a bit overwhelmed by the amount of information on publishing apps to AppExchange. Could please someone clairify how the following scenarios would go?
Let's suppose that our clients are using our ...
- 1,034
1
vote
1
answer
559
views
Changing callback url in connected app & security review
We have created managed package and submitted it for security review. We are using connected app to push data into SFDC from our web application. Right now its integrated with our QA site. e.g. https:/...
- 9,120
1
vote
1
answer
107
views
Security Review Step 5 issue
I've reached Step 5 of the Security Review submission for my new Managed Package. I've created a new Developer Org, installed the package and then proceeded to continue with the review.
At step 5, ...
- 759
1
vote
1
answer
108
views
JS in Salesforce DOM security review failure
I have just been sent back the security review report for our ISV partner app and one of the errors is 'JS in Salesforce DOM'. The file they have referenced is a .weblink file, the code snippet they'...
- 41
1
vote
1
answer
333
views
Is there any way to set feature parameters for beta versions which did not pass security review?
Is there any way set feature parameters for package beta versions which did not pass security review?
Assuming you are going to release a new version of package which will include feature parameters.
...
- 16.7k
1
vote
1
answer
285
views
Managed Package, Security Review and LWC DOM Manipulation
I started developing a managed package and I need to manipulate the DOM in a Lightning Web Component, In the component HTML, I added lwc:dom="manual" to the target element and everything ...
- 151
1
vote
1
answer
235
views
Remove Sample Code references in Managed package metadata
One of our partners reached out to us in helping their package pass security review. The recent report they received contains the following issue:
Sample Code in Production
Account.object
Issue ...
- 10.1k
1
vote
2
answers
169
views
Security review issue "Password Echo"
I have submitted to my app to security review, it resulted me "Password Echo" issue. App consists of a protected custom settings to store the username and password. we have implemented UI to insert/...
1
vote
1
answer
89
views
Enforce Shield encryption, still valid for security review?
Just went through Security Requirements Checklist (https://developer.salesforce.com/page/Requirements_Checklist) in order to verify things that could be detected as a vulnerability in our app for ...
- 941
1
vote
2
answers
354
views
Conditional logic or throwing an exception when checking FLS and object CRUD?
When checking Field-Level Security or object CRUD in Apex within a managed package, is it required to use conditional access to prevent the given operation (for the purposes of passing the security ...
- 1,737
1
vote
1
answer
113
views
How to use the security scanner when you need your code in a package?
I'm creating a package in a Developer Edition and there's a couple reasons why I want to keep all my components (apex code, visualforce pages, etc) in a package.
It lets me subscribe to the ...
- 673
1
vote
1
answer
80
views
What is the meaning of this error message?
I got an unmanaged package from the developer. I installed it in the developer org. Created a managed package from the components and gave the managed package for security review.
Here is the message ...
- 1,124
1
vote
1
answer
229
views
SF Security Review Questioner - single org solution vs hybrid single org solution
I came across this question in Salesforce Security Review Process. But I am not sure what to choose.
Is your offering a single org solution of hybrid single org solution?
Options:
A : Single ...
- 2,466
1
vote
1
answer
142
views
Does using the atob and btoa Javascript functions impact Salesforce Security Review?
We have a Second Generation Managed Package where we need to get the data from a JSON file. So using apex we are able access data of the JSON files having size less than 6 MB due to the heap size ...
- 133
1
vote
1
answer
112
views
Salesforce package version creation after resolving the errors
We are planning to publish the package to the appexchange security review process before which we have run through a security scan. The package version is 0.1.0-1. After resolving the errors from the ...
- 473
1
vote
1
answer
185
views
Sending review to the checkmarx where multiple developments are included
I have a org that is connected to the partner community. In this org, there are managed packages, unmanaged packages, and various other developments that includes code that is not required for the ...
- 473
1
vote
1
answer
107
views
Pass SF security review and keep <apex:pageMessages escape="false"/> in a visualforce page
to pass security review we must avoid <apex:pageMessages escape="false"/>
But without the escape="false", my message will not be clickable anymore.
So inside my controller, I ...
- 11
1
vote
1
answer
357
views
Checkmarx - Bulkify Apex Methods Using Collections In Methods
Recently I ran a checkmarx scan and saw this issue
Query: Bulkify Apex Methods Using Collections In Methods
I don't understand why checkmarx is showing this issue in few places and not in all methods....
- 303
1
vote
1
answer
70
views
not checking for Id in FLS checks before query and DML [duplicate]
I am not checking for Id in FLS checks before query and DML. Is this a security review vulnerability in salesforce?
1
vote
1
answer
826
views
How to remove Salesforce CRUD Delete Security Risk?
When I scanned my app yesterday, and it raised a bunch of CRUD Delete security issue. So, I added isDeletable() check to all the delete query, and scanned it again. Still, it showed the same security ...
- 291
1
vote
1
answer
1k
views
Secure Object Permissions for Guest Users (Security Alert) May 2020
I am a little bit confused with this security alert that will take place in May of 2020.
Within the sandbox they only list 3 objects, where this update will be affected
Contracts, Order, and ...
- 1,953
1
vote
1
answer
70
views
Security review vs lightning readiness [closed]
We're in the process of submitting the ap through Salesforce Security Review and kind of unsure if Lightning Readiness Report is important to pass the review.
Can someone shed some light on this?
- 23
1
vote
1
answer
459
views
Query: Hardcoding Of Trigger New
I have wrote an trigger which works fine functionality wise but when we send our product for security review it says
Query: Hardcoding Of Trigger New
Below is my trigger
trigger CostTrigger on ...
- 159
1
vote
1
answer
643
views
Salesforce security review - ID field fls create
In salesforce security review am getting a error FLS create which is for ID field. so when a FLS create error occurred, validated the isCreateable or isUpdatebale for update condtion.
Here how to ...
- 461
1
vote
1
answer
121
views
How can I send third party user login information from salesforce to a target API securely?
I am in the thick of creating a salesforce application. I just got my security review back and was rejected because of "Insecure Storage of Sensitive Data". I've read the description of the issue as ...
1
vote
1
answer
197
views
Error from security review
if(dupObjDel !=null && dupObjDel.size() > 0 ) {
if(isSafeObjectDel( dupObjDel ) ) {
delete dupObjDel; // ERROR in this line
}
}
public ...
- 11
1
vote
1
answer
545
views
Security review test org for managed package
According to Security Review Test Info,
"Starting March 1, 2017 full Locker Compliance will be mandatory to submit for the security review. Therefore, the Developer Edition test environment provided ...
- 255
1
vote
1
answer
307
views
How to cache CRUD/FLS access checks
In the Connect to Salesforce with Server-Side Controllers module on trailhead, when advising of the requirement to do CRUD/FLS checks, the author cautions:
Also, describe calls are expensive. If ...
- 203
1
vote
1
answer
181
views
Scan report for custom REST service for security review. Is that mandatory?
We are about to submit our app for the security review process. I have created two REST resources in Salesforce and they are accessed from SAP system. SAP will send JSON i/p to Salesforce using that ...
- 6,828
1
vote
1
answer
2k
views
Alternative to String.escapeSingleQuotes to avoid XSS
I have a few places in my code that were flagged as "Stored XSS" and "Reflected XSS" respectively. Here's an example of a "Stored XSS" vulnerability:
Database.query('select Id, Name,
Email from ...
- 673
1
vote
1
answer
254
views
Salesforce Security Review Error - Possible XSS / escape='false'
Salesforce Security Review Error - Possible XSS / escape='false' : How to solve this issue for the below set of line
$calEvent.find(".wc-time").html(calEvent.status+"<br/>
<div style='font-...
1
vote
2
answers
226
views
Prepopulate fields in edit mode and passing security review
I'm looking at publishing an application on AppExchange - most of this application is built using point-and-click, no APEX was needed for the first releases. There is a couple of fields that I want to ...
- 710
1
vote
2
answers
2k
views
How to BURP test our outbound message endpoint?
We are using some workflows and trigger to send out outbound messages to a listening end-point of ours. We are going into a security review with SF and that requires some testing using BURP. What I ...
- 773
1
vote
1
answer
44
views
Source Scanner Results:Query: Bulkify Apex Methods Using Collections In Methods
The Salsesforce Source Scanner if flagging my DatabaseFLS class for "Query: Bulkify Apex Methods Using Collections In Methods" with 5 issues, and provides the below:
This best practice is ...
- 25
1
vote
0
answers
66
views
Checkmarx reporting wrong function name?
I just ran a Checkmarx scan today. It reported the following Apex Serious Security Risk:
You can see the report is making a reference to isCreatable(). However, the name of the method in my Apex code ...
- 510
1
vote
0
answers
170
views
What does the Dereferenced Field vulnerability in Security Review scan means?
I've received a vulnerability from Checkmarx scan that is labelled as Dereferenced Field vulnerability.
The scan report message reads like this:
A possible dereference exist in method uploadDocument. ...
- 5,950
1
vote
0
answers
410
views
Transport False-Positive comments to Checkmarx report
I want to find the best way to address false positives in the Checkmarx report. One of the points I am investigating is how to make the Checkmarx report to display the false positive comment that has ...
- 695