17

I would strongly suggest reading this recent post by Dan Appleman. He outlines the various ways in which factors like sharing and CRUD/FLS play into security, and ends with the comment, which tells me you can pass security review with classes not marked as sharing so long that is clear to the users administering the system which uses that construct: But ...


13

Having been involved in one of those applications, i can say that there was no official list of things they provided, maybe their will be in due course, though the documentation does a pretty good job of describing the features to use. As such having your package make use of one or more of the following Salesforce1 features is going to allow you to be ...


11

Do I need separate orgs for development and packaging? No, but it is strongly recommended. For today, ISVs use unmanaged Development Edition orgs. In DX, you'll be using throw-away orgs for development, and a primary packaging org to distribute your app. You need one packaging org per managed package. Do the orgs need to remain the same through out the ...


10

Here are your answers: Salesforce has a license to run Checkmarx scanners on premise in order to scan third party code. The code never leaves Salesforce -- it is pulled from the organization in which your code resides to the Checkmarx instances running on our servers. We manage these instances, but it is a Checkmarx scanner engine underneath. Results are ...


10

Long Story: Quoting examples from apex documentation: // User supplied value: name = Bob // Query string SELECT Id FROM Contact WHERE (IsDeleted = false and Name like '%Bob%') However, what if the user provides unexpected input, such as: // User supplied value for name: test%') OR (Name LIKE ' SELECT Id FROM Contact WHERE (IsDeleted = false AND Name ...


9

You can use JSENCODE in tandem with the built-in Javascript method JSON.parse. var myEscapedObject = JSON.parse("{!JSENCODE(serializedOptions)}");


9

A free app is one in which salesforce security review won't cost you any money and your app can be installed by consumer free of cost. In a paid app you can control the license and the consumer will have to go through a payment portal to make payment and purchase license. Salesforce provides you with a LMA application to manage licenses. LMA is a Salesforce ...


9

There is a slight possibility for XSS since you are allowing the RootComponent to be extended . One could throw a mark up like below <aura:component access="global" extends="c:RootComponent" description="Child extension of RootComponent"> <!-- ... lof of other code ... --> <label>{!v.label}</label> <aura:...


8

I have some notes on using the BURP scanner to test a web service for submission to the security review - Using the Burp Suite to test a Web Service that is consumed in a Salesforce app. The basic idea is: Have BURP intercept typical requests by acting as a proxy as you browse around the site. If it is Salesforce calling a web service you will need to ...


8

You do not need to rewrite the code to eliminate scanner false positives -- there will always be false positives. However, if you want to rewrite the code, then you can replace a boolean with a text literal and then cast to a Bool. <script> var foo = Boolean('{!JSENCODE(IF(MyObject__c.chk_CheckboxField__c,"true", "false"))}'); //absurd way to quiet ...


8

I have faced exactly same problem. Salesforce does not clearly tell you what need to scan and as being SFDC developer we go and scan na1.salesforce.com. Which is not required to scan with Burp. Your development on force.com must be scanned with Force.com Security Source Code Scanner If you are calling out any API from force.com then you should scan those ...


8

You are calling a loop with setInterval. This loop will continue to run because it is attached to the window, but the lifecycle of your component is not the life cycle of the window. E.g. if your component is unrendered, say because a user closes the tab in which your component was running, the window object will still be there running that interval long ...


8

For a single field as a string, if you know the sObjectType as a string also, you can do: public static Boolean isAccessible(String sObjectType, String fieldName) { SObjectType schemaType = Schema.getGlobalDescribe().get(sObjectType); Map<String, SObjectField> fields = schemaType.getDescribe().fields.getMap(); DescribeFieldResult ...


8

You don't need to check every field that you query. The issue really boils down to who manages security for the field -- your app or the admin. With standard objects, the answer is always the admin. With custom objects, it depends on whether the field is user visible and is used by users or whether it is internal and used only by your app. Things like wizard ...


8

One further observation is that dynamic SOQL does support simple (not dotted expressions or method calls) bind variables that also protect against SOQL injection. So for some dynamic SOQL cases you can use do something like this: String nameLike = '%' + nameSearchField +'%'; String query = 'select ... from ... where Name like :nameLike'; that is a ...


8

For Finding vulnerabilities in the API only application(does not have a web app and you have access to only its REST API), you can configure proxies in the Postman and execute OAuth and other REST api invocations and network requests goes through same proxy that ZAP is configured to intercept. If You have web app you can configure your browser as proxy so ...


7

Salesforce support has tools to undo a managed package release. They do this by converting you "managed - released" package into a "managed - beta" which undoes the locking with newly added components. There is one major prerequisite before they can do this: the version you want to un-release needs to be uninstalled from ALL organizations. This can pose a ...


7

Lets first understand what is XSS and see what are the possible ways to prevent this Cross-site scripting(XSS) is a vulnerability that occurs when an attacker can insert unauthorized JavaScript, VBScript, HTML, or other active content into a web page viewed by other users. A malicious script inserted into a page in this manner can hijack the user’s ...


7

You can generally ignore informational BURP issues. The TE team should have a list of which BURP issues can be ignored and which need to be addressed. The following issues can be ignored, modulo caveats in comments: Informational issues about crossdomain.xml files/silverlight cross domain sharing or use of HTML 5 CORS. As long as the file/header is not ...


7

During the security review process ,following things are checked 1.Apex code Security best practices .Force.com scanner is good tool to point out any risks 2.All your end points will be BURP Scanned .If your application makes a call to external SAP url ,even SAP URL will be BURP Scanned to discover any potential threats .Note for partners BURP Scanner is ...


7

If your component's init action invokes an server-side method which queries(i.e Read) records, then you are fine. For example : <aura:handler name="init" value="{!this}" action="{!c.initializeComponent}"/> Controller.js ({ initializeComponent: function(component, event, helper) { // api request to my external endpoint var ...


7

I assume you are asking what you need to do about this item flagged in the security review. Apex code - such as a controller - does not automatically respect the CRUD settings of the user's profile. You have to add explicit code that checks attributes such as isAccessible and isCreatable from the DescribeSObjectResult API. The aim is to get your Visualforce ...


7

My solution for determining the users email address is going to be to make a SOQL query to the sObject 'User' immediately after the OAuth flow completes. Is there something similar I can do for namespace prefix? Yes, since Spring `16 you can query Organization.NamespacePrefix in SOQL. SELECT NamespacePrefix FROM Organization It's a bit more work, but you ...


6

Yes you do have to submit your application for security review; all apps must be vetted to ensure they're not a potential risk to customers' data. For free apps the review is free, currently it's $2700 for paid applications.


6

You cannot pass security review with classes marked as without sharing, the security scanner will always report these files as being a security violation. Without Sharing gets flagged by the security scanner because you can write code that disregards the organizations security model with it. It's important to only use without sharing when absolutely ...


6

In order to pass the security review, every controller or controller extension must have 'with sharing'. There are no exceptions to this. However, if you need to perform some privileged action (and there is a valid business reason for this), then you can make a helper class with an explicit 'without sharing' declaration, and call the helper class from your ...


6

If you want to be cautious, you can check that it is an actual field first. Possibly easier to sanitize input than enforce namespace. public static List<Contact> safeQuery(MyCustomSetting__c setting, String filterValue) { SObjectField field = SObjectType.Contact.fields.getMap.get(settng.Filter_Field__c); if (field != null && field....


6

You should not fail the security review because of this, as rich text areas are safe types to render unescaped. Other safe types are listed in the secure coding guidelines. However be aware that what determines the safety of the data type is not the input type in the visualforce page but the data type in your object model. Make sure it's really an RTF type. ...


6

Well your assumption about call will be always made by Admin user is not 100% correct. In fact any user can oAuth. So from salesforce standpoint it may happen that user have permission for oauth but no permissions on fields. so to fix this you will need to check in apex To check the field-level update permission of the contact's email field before ...


6

In the org you are developing the managed package in that namespace is implied when no namespace is specified. In the case of customer orgs this is not true - they have their own namespace for unmanaged components, and your namespace needs to be explicitly included on apexrest requests. The docs do describe this, but it's a bit down the page and easy to ...


Only top voted, non community-wiki answers of a minimum length are eligible