Skip to main content

Questions tagged [security-scanner]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
51 views

For stripInaccessible checks on READ operation discard unsanitized data

Salesforce does a terrible job at providing documentation for addressing errors thrown by its own tools. For example, after executing the sf scanner dfa command, we get the following error: For ...
dev4life's user avatar
  • 532
2 votes
1 answer
19 views

Resolving ApexXSSFromURLParam scanner issues while preserving reasonable values

I'm doing some proactive code cleanup based on scanner results and trying to find a way to remove ApexXSSFromURLParam issues while maintaining proper functionality. Consider the code... String testMe =...
Ken's user avatar
  • 430
0 votes
1 answer
42 views

How to set rules in vscode salesforce security scanner

I'd like to be able to set what rules run when running the Salesforce Security Scanner from within VSCode. There are times when I'm solely interested in security issues and I want to filter out noise,...
Ken's user avatar
  • 430
1 vote
1 answer
68 views

Any problem passing a Salesforce security review if LWCs are using GraphQL?

GraphQL queries can be made from LWCs as below (from a GraphQL document Make Your Variables Reactive): @wire(graphql, { query: gql` query bigAccounts($minAmount: Currency) { uiapi {...
Keith C's user avatar
  • 136k
2 votes
1 answer
167 views

Salesforce code analyzer DFA

Im hitting a strange error when running the salesforce code analyzer DFA report - sf scanner run dfa --format csv --outfile CodeAnalyzerDFA.csv --target ./ --projectdir ./ --category Security Scanner ...
ravent's user avatar
  • 57
1 vote
0 answers
37 views

ZAP Scan: Apex callout to our backend API

I am in the process of preparing materials for our security review submission. I have a case where our Apex code calls out to our backend API: Directly from Apex code Background job: Schedule, ...
vctqs1's user avatar
  • 95
0 votes
0 answers
51 views

SFDX Scanner DFA: [READ] operation with field(s) [Unknown]

I'm getting this error warning:Unknown field on SOQL. packages/lesson/main/default/classes/EligibleSubjectHandler.cls:3 packages/lesson/main/default/classes/EligibleSubjectHandler.cls:30 ...
vctqs1's user avatar
  • 95
0 votes
1 answer
66 views

Security review failed due to debug lines

So the salesforce security review of my mannaged package failed due to data in log lines they have stated the below: Issue Description Revealing information in debug statements can help reveal ...
ravent's user avatar
  • 57
0 votes
1 answer
89 views

Question about Endpoint scanning (ZAP) for security review

As part of the Salesforce security review they state: If your solution connects to any non-Salesforce domains, also run Chimera, ZAP, or Burp Suite on the external endpoints. Include reports from your ...
ravent's user avatar
  • 57
0 votes
0 answers
93 views

Test Methods With No Assert result

I'm using the Salesforce code scanner to validate my package and am seeing a lot of "Test Methods With No Assert result" messages for methods that do contain asserts, and test methods run ...
ravent's user avatar
  • 57
1 vote
1 answer
57 views

Source Scanner Results:Query: Bulkify Apex Methods Using Collections In Methods

The Salsesforce Source Scanner if flagging my DatabaseFLS class for "Query: Bulkify Apex Methods Using Collections In Methods" with 5 issues, and provides the below: This best practice is ...
ravent's user avatar
  • 57
0 votes
0 answers
232 views

Salesforce Code Analyser

Im having trouble identifying what is wrong with the below method, the salesforce code analyser if flagging it as a InternalExecutionError with the below error: Is anyone able to explain what the ...
ravent's user avatar
  • 57
0 votes
1 answer
28 views

How to detect Formula Expressions exposing vulnerable information like session id?

There is a snippet from the Salesforce Security Guide (Version 58.0) Formula Tag heading explaining why it is a security vulnerability : The general syntax of these tags is:{!FUNCTION()} or {!$OBJECT....
compski's user avatar
  • 1,352
0 votes
2 answers
692 views

sfdx scanner - Install problem

I have installed:- Visual Studio Code Version 1.80.1 on Windows 11 "C:\Program Files\Java" with directories: jdk-17.0.5 jdk-20 and jre-1.8 VS Terminal Command: sfdx update completed ...
Stoicorum's user avatar
0 votes
1 answer
387 views

Security scan is complaining on setEndpoing

My company uses a security scan tool called Snyk to scan code for security vulnerabilities. It is complaining about a Server-Side Request Forgery (SSRF) vulnerability. The details says Unsanitized ...
James's user avatar
  • 337
1 vote
0 answers
75 views

Checkmarx reporting wrong function name?

I just ran a Checkmarx scan today. It reported the following Apex Serious Security Risk: You can see the report is making a reference to isCreatable(). However, the name of the method in my Apex code ...
dev4life's user avatar
  • 532
0 votes
2 answers
110 views

Using SOQL Injection to delete data

I know that SOQL injection can be used to query data the user shouldn't see by providing a value like Bob \' OR Name LIKE '%'. But I'm wondering if you could use an input value like Name LIKE '%')'; ...
Tom's user avatar
  • 152
4 votes
2 answers
1k views

Strange error is showing when trying to open partner security portal with primary partner community user

https://security.secure.force.com/sourcescanner/ is down for maintenance Sorry for the inconvenience. We'll be back shortly. Please email us if you need to get in touch. This error is shown when I ...
Patlatus's user avatar
  • 17.2k
1 vote
0 answers
175 views

Access to Security Portal (Scanner) when building 2GP

I work as a PDO partner for a customer who wants to have an app on App Exchange. We develop a 2GP package, where Dev Hub is located in the customer PBO, which is linked as an organization to App ...
Anna Walach's user avatar
0 votes
1 answer
201 views

Is fixing "Apex Code Quality" issues necessary for passing security review?

I have fixed all the "Apex Critical Security Risk" issues but there are few apex code quality issues remaining. Some of them are false positives and some are correct. But due to time ...
Manjot Singh's user avatar
  • 3,526
-1 votes
1 answer
43 views

Which Salesforce scanner tool can I use to scan Chrome Extension(built on Angular utilizing Salesforce APIs)?

We have a Chrome Extension built upon Angular utilizing Salesforce APIs, now We want to publish it on APP Exchange, so we have to upload a scanner report, which scanner tool can we use? I tried using ...
Sagar Alwani's user avatar
1 vote
0 answers
127 views

EmailTemplate is not accessible for community user in managed package

I wanted to send an email using one of my Email Templates from community user. The email template folder where this email template is stored has Read/Write access & is accessible to all users. if(...
SK2889's user avatar
  • 921
7 votes
1 answer
361 views

Best (commercial) Scanner to stay prepared for Security Review

For ISVs to be safe to (re)submit their app for Security Review without issues Checkmarx still is the only authoritative tool. But it is also cumbersome and limited as: Community Scanner is limited ...
Robert Sösemann's user avatar
0 votes
1 answer
425 views

Why newly released package version is not available in Partner Security Portal scanner?

We have released a new minor 2GMP release version and try to check it for Security and Quality rules in Partner Security Portal scanner, but the new version doesn't show up in the picklist for Select ...
Patlatus's user avatar
  • 17.2k
3 votes
1 answer
2k views

How can I mitigate URL redirection attacks?

I have been trying to fix this URL Redirection Attack code block: String url = '/' + oGenericObj.getDescribe().getKeyPrefix() + '/e'; if (strObject.equals('Quote')) { url += '?oppid=' + System....
Jigar Trivedi's user avatar
-2 votes
1 answer
682 views

Security Scanner Report in Owasp zap

How to scan my salesforce app in Owasap zap, need to cover everything such as custom objects, flow, process builder, reports and dashboard, etc. at the end need to generate a report, is possible?
Catherin's user avatar
1 vote
1 answer
396 views

Checkmarx - Bulkify Apex Methods Using Collections In Methods

Recently I ran a checkmarx scan and saw this issue Query: Bulkify Apex Methods Using Collections In Methods I don't understand why checkmarx is showing this issue in few places and not in all methods....
Megha Goel's user avatar
3 votes
0 answers
171 views

Publishing platform event in doInit of Aura or page load action cause any security vulnerability? [closed]

We have a scenario to publish platform event in doInit of Aura Component (or) action of visualforce page, where in the platform event trigger we're making a dml. As far as we researched and debugged, ...
Yaswanth Tikkisetti's user avatar
2 votes
0 answers
584 views

FLS and CRUD Check for Platform event and Meta Data DML

This might be a silly question, but don't want to get caught under security review. I have three questions/confirmations related to the security review FLS/CRUD Check Needed while publishing platform ...
Yaswanth Tikkisetti's user avatar
1 vote
0 answers
296 views

Not able to fix checkmarx scanner issue

I am trying to fix checkmarx scanner issue in different ways but nothing helps to fix FLS Update and Crete. Below are the things I tried if(Schema.sObjectType.ProviderRecordQuestion__c.fields....
SFDC-Beginner's user avatar
0 votes
0 answers
116 views

Not able to reproduce checkmarx scann results using SFDX scanner

We got these below eeors when we submitter our code for security review in salesforce portal In order to fix the issue we are trying to replicate the issues using SFDX scanner in our local but SFDX ...
SFDC-Beginner's user avatar
0 votes
1 answer
108 views

Code Scanner Portal show error in browser console

I try do security scanner for our code. I use this "Force.com Code Scanner Portal" website to do it. This is the website link: https://security.secure.force.com/security/tools/forcecom/...
GhostLee's user avatar
0 votes
0 answers
199 views

getting Client DOM Code Injection security issue in lightning controller

In scanning, I got Client DOM Code Injection security issue in lightning controller for below section: window.addEventListener("message", function(event) { var message = event.data; }, false)...
user92818's user avatar
7 votes
1 answer
254 views

Package review fails with new undocumented issues

My Managed package (yearly) Security Review failed with new issues I was not aware of and which I could not find documented anywhere, E.g.: Stored XSS - "Avoid using escape=false unless ...
Robert Sösemann's user avatar
5 votes
1 answer
2k views

How to run Source Code Scanner / Checkmarx against a Scratch Org?

Is it possible to run Source Code Scanner / Checkmarx against a Scratch Org? When I click the Login link on this page: https://security.secure.force.com/sourcescanner/ It redirects me to: https://...
Robs's user avatar
  • 9,396
1 vote
1 answer
965 views

How to remove Salesforce CRUD Delete Security Risk?

When I scanned my app yesterday, and it raised a bunch of CRUD Delete security issue. So, I added isDeletable() check to all the delete query, and scanned it again. Still, it showed the same security ...
Jayesh Babu's user avatar
0 votes
1 answer
343 views

SOQL injection issue on source scanner report

I am getting SOQL injection vulnerability on source scanner report. Please check one of the issue below. I tried string.escapeSingleQuotes() on query string. It is helping with removing this issue in ...
AshSFcloud's user avatar
1 vote
0 answers
471 views

What is the client DOM Code Injection in lightning component?

The security scanner alert us about client DOM code injection on this lines: L 110: event.data.charge.Auctifera__Contribution__c = recordId ... L 134: params['chargeData'] = JSON.stringify(event....
Ana María Cabrera's user avatar
3 votes
1 answer
469 views

Endless loop of Chimera scans with failure

Today I started a Chimera scan from https://security.secure.force.com/sourcescanner/chimera__chimera_portal to scan an external API we use in an ISV app which is going into Security Review soon. ...
Robert Sösemann's user avatar
1 vote
2 answers
1k views

Is there any Lightning Component Code Scanning Tool?

I have used Checkmarx, Code Scan and PMD for code scanning for Apex and Visualforce Pages. I would like to know if there is any such tool for scanning Lightning components (Aura & Web)? As part ...
Bugude's user avatar
  • 390
1 vote
1 answer
575 views

FLS Create Error

My code on scanner report gives some FLS Create errors code like this public static cg__SURL__c upsertPublicLink(cg__SURL__c sUrl){ if (String.isEmpty(sURL.cg__SUrl_Id__c)) { String ...
Bernard Black the Second's user avatar
0 votes
1 answer
2k views

How to solve Reflected XSS error in query referenced in my Visualforce Component

When I sent my code to security scan I got Reflected XSS error. How to solve this issue? I wrapped the variable with Jsencode. Visualforce component is not saving. Below is the code where I got that ...
SalesforceElearner's user avatar
1 vote
1 answer
756 views

check FLS and CRUD for more than one field

I have a code which inserts custom Note__c object by using 5 fields. I want to check FLS and CRUD permission field level wise as they are reported in the checkmarx report. I know we can write in if ...
AJoshi's user avatar
  • 33
7 votes
2 answers
4k views

Checkmarx Force.com Security Source Scanner - any way to mark known false-positives?

For the Force.com Security Source Scanner, is there a mechanism of the same nature as eslint-disable-line for inhibiting known false-positive reports? With the false positives excluded, future scans ...
Keith C's user avatar
  • 136k
1 vote
2 answers
129 views

Force.com Source Scanner Results to CSV/JSON

Has anyone found a nifty way to convert results from the Force.com Source Scanner into CSV or JSON? I have over 300 small issues (mainly API version and FLS Creates), and want to push them into our ...
developer__c's user avatar
  • 1,307
6 votes
1 answer
518 views

SOQL inside a While loop is not detected in Security review

Noticed a weird thing, SOQL inside a for loop is a bad practice but in a while loop isn't? Force.com security scanner has not detected a SOQL inside a while loop and also note that our paid ...
Raul's user avatar
  • 18.8k
0 votes
1 answer
470 views

Code Scanner Report Query: XSRF Apex Serious Security Risk [duplicate]

I ran CheckMarx security code scanner and found this 1 security risk issue for a Button on Opportunity that opens a VF page (generates pdf). From the code report, here is the issue mentioned. Can ...
sfdcFanBoy's user avatar
  • 4,084
4 votes
0 answers
202 views

How to generate scan results for the external endpoints to pass salesforce security review?

I have build Salesforce appexchange app and i have used amazon s3 server api to store files in amazon server. I have generated the report for security and quality check but i dont know how to generate ...
Sagar Thoriya's user avatar
2 votes
1 answer
112 views

Security reviews in Salesforce

A monthly report is being run by our client to check the security of their portal on Salesforce. The report is run using TrustWave. Problem: A threat that report shows is known as Sweet32 or the ...
Mohit Arora's user avatar
1 vote
0 answers
280 views

FLS Update for id field

In the case of record update, we will use the Id field to specify Id value. How to check FLS for Id field. I have already check isAccesible method. But still, it shows in the security scanner. Is it a ...
Monish's user avatar
  • 551