17 votes
Accepted

How to pass security review when using "Without sharing" by design?

I would strongly suggest reading this recent post by Dan Appleman. He outlines the various ways in which factors like sharing and CRUD/FLS play into security, and ends with the comment, which tells ...
user avatar
11 votes
Accepted

Salesforce development and security review lifecycle

Do I need separate orgs for development and packaging? No, but it is strongly recommended. For today, ISVs use unmanaged Development Edition orgs. In DX, you'll be using throw-away orgs for ...
user avatar
  • 429k
10 votes
Accepted

How Checkmarx works

Here are your answers: Salesforce has a license to run Checkmarx scanners on premise in order to scan third party code. The code never leaves Salesforce -- it is pulled from the organization in which ...
user avatar
10 votes
Accepted

SOQL Injection Vulnerability

Long Story: Quoting examples from apex documentation: // User supplied value: name = Bob // Query string SELECT Id FROM Contact WHERE (IsDeleted = false and Name like '%Bob%') However, what if the ...
user avatar
  • 7,521
9 votes
Accepted

How to JSENCODE from an apex controller?

You can use JSENCODE in tandem with the built-in Javascript method JSON.parse. var myEscapedObject = JSON.parse("{!JSENCODE(serializedOptions)}");
user avatar
  • 142k
9 votes
Accepted

What is the main difference between Paid App or Free App on the AppExchange?

A free app is one in which salesforce security review won't cost you any money and your app can be installed by consumer free of cost. In a paid app you can control the license and the consumer will ...
user avatar
9 votes

Sanitizing global string attributes - necessary or not?

There is a slight possibility for XSS since you are allowing the RootComponent to be extended . One could throw a mark up like below <aura:component access="global" extends="c:RootComponent" ...
user avatar
9 votes
Accepted

How to OWASP ZAP scan external REST API using OAuth2

For Finding vulnerabilities in the API only application(does not have a web app and you have access to only its REST API), you can configure proxies in the Postman and execute OAuth and other REST api ...
user avatar
8 votes

Burp Scanner in Salesforce

I have faced exactly same problem. Salesforce does not clearly tell you what need to scan and as being SFDC developer we go and scan na1.salesforce.com. Which is not required to scan with Burp. Your ...
user avatar
  • 8,979
8 votes

Security Scanner finds XSS False Positives / JSENCODE incompatible with Boolean fields?

You do not need to rewrite the code to eliminate scanner false positives -- there will always be false positives. However, if you want to rewrite the code, then you can replace a boolean with a text ...
user avatar
8 votes
Accepted

Security Review: Illegal DOM Access in Lightning Component

You are calling a loop with setInterval. This loop will continue to run because it is attached to the window, but the lifecycle of your component is not the life cycle of the window. E.g. if your ...
user avatar
8 votes
Accepted

How to check isAccessible() for a dynamic list of field names?

For a single field as a string, if you know the sObjectType as a string also, you can do: public static Boolean isAccessible(String sObjectType, String fieldName) { SObjectType schemaType = ...
user avatar
  • 142k
8 votes

Security Review - CRUD/FLS Checks for every SOQL Query

You don't need to check every field that you query. The issue really boils down to who manages security for the field -- your app or the admin. With standard objects, the answer is always the admin. ...
user avatar
8 votes

SOQL Injection Vulnerability

One further observation is that dynamic SOQL does support simple (not dotted expressions or method calls) bind variables that also protect against SOQL injection. So for some dynamic SOQL cases you ...
user avatar
  • 129k
7 votes

Rolling back a managed released package?

Salesforce support has tools to undo a managed package release. They do this by converting you "managed - released" package into a "managed - beta" which undoes the locking with newly added components....
user avatar
  • 22.1k
7 votes

How do I fix Stored XSS and Reflected XSS?

Lets first understand what is XSS and see what are the possible ways to prevent this Cross-site scripting(XSS) is a vulnerability that occurs when an attacker can insert unauthorized JavaScript, ...
user avatar
7 votes
Accepted

Informational Issues in BURP Scan Report

You can generally ignore informational BURP issues. The TE team should have a list of which BURP issues can be ignored and which need to be addressed. The following issues can be ignored, modulo ...
user avatar
7 votes
Accepted

What would really happen in the security review before listing our app in AppExchange?

During the security review process ,following things are checked 1.Apex code Security best practices .Force.com scanner is good tool to point out any risks 2.All your end points will be BURP ...
user avatar
7 votes
Accepted

Lightning security on init page load with server-side call

If your component's init action invokes an server-side method which queries(i.e Read) records, then you are fine. For example : <aura:handler name="init" value="{!this}" action="{!c....
user avatar
  • 10.1k
7 votes

Salesforce Security Review Field Object (CRUD) and FLS are configured on profiles

I assume you are asking what you need to do about this item flagged in the security review. Apex code - such as a controller - does not automatically respect the CRUD settings of the user's profile. ...
user avatar
  • 129k
7 votes
Accepted

Security Review Oauth Callback "Insecure Storage of Sensitive Data"

My solution for determining the users email address is going to be to make a SOQL query to the sObject 'User' immediately after the OAuth flow completes. Is there something similar I can do for ...
user avatar
6 votes

How to pass security review when using "Without sharing" by design?

You cannot pass security review with classes marked as without sharing, the security scanner will always report these files as being a security violation. Without Sharing gets flagged by the security ...
user avatar
  • 6,089
6 votes

How to pass security review when using "Without sharing" by design?

In order to pass the security review, every controller or controller extension must have 'with sharing'. There are no exceptions to this. However, if you need to perform some privileged action (and ...
user avatar
6 votes
Accepted

Genuine SOQL Injection issue or False Positive?

If you want to be cautious, you can check that it is an actual field first. Possibly easier to sanitize input than enforce namespace. public static List<Contact> safeQuery(MyCustomSetting__c ...
user avatar
  • 142k
6 votes
Accepted

XSS : Rich textarea content security review issue when using escape=false

You should not fail the security review because of this, as rich text areas are safe types to render unescaped. Other safe types are listed in the secure coding guidelines. However be aware that what ...
user avatar
6 votes
Accepted

How to fix an FLS security vulnerability?

Well your assumption about call will be always made by Admin user is not 100% correct. In fact any user can oAuth. So from salesforce standpoint it may happen that user have permission for oauth but ...
user avatar
  • 8,979
6 votes

Managed package API URL is different then unmanaged package?

In the org you are developing the managed package in that namespace is implied when no namespace is specified. In the case of customer orgs this is not true - they have their own namespace for ...
user avatar
  • 22.1k
6 votes
Accepted

Sanitizing global string attributes - necessary or not?

If this is really a label as you describe, then this is a false positive. However you may have left something out of your description. If you could please send me a message with the details of the ...
user avatar
6 votes
Accepted

Is retrieving data from REST API in Apex consistent with ISV security guidelines?

There shouldn't be any problem; after all, the REST API won't give users any more access than they'd have in the UI (e.g. you can't query records you couldn't view in the UI, etc). They will, of ...
user avatar
  • 429k
6 votes
Accepted

Apex Source Scanner flag CRUD/ FLS as security risk for no reason

To help others who end up here, my response as an answer: From what you posted, looks like a false positive - so I would document it in review. Here is a link to a recent update from the SR team ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible