17

I would strongly suggest reading this recent post by Dan Appleman. He outlines the various ways in which factors like sharing and CRUD/FLS play into security, and ends with the comment, which tells me you can pass security review with classes not marked as sharing so long that is clear to the users administering the system which uses that construct: But ...


13

Having been involved in one of those applications, i can say that there was no official list of things they provided, maybe their will be in due course, though the documentation does a pretty good job of describing the features to use. As such having your package make use of one or more of the following Salesforce1 features is going to allow you to be ...


11

Do I need separate orgs for development and packaging? No, but it is strongly recommended. For today, ISVs use unmanaged Development Edition orgs. In DX, you'll be using throw-away orgs for development, and a primary packaging org to distribute your app. You need one packaging org per managed package. Do the orgs need to remain the same through out the ...


9

A free app is one in which salesforce security review won't cost you any money and your app can be installed by consumer free of cost. In a paid app you can control the license and the consumer will have to go through a payment portal to make payment and purchase license. Salesforce provides you with a LMA application to manage licenses. LMA is a Salesforce ...


9

There is a slight possibility for XSS since you are allowing the RootComponent to be extended . One could throw a mark up like below <aura:component access="global" extends="c:RootComponent" description="Child extension of RootComponent"> <!-- ... lof of other code ... --> <label>{!v.label}</label> <aura:...


8

I have some notes on using the BURP scanner to test a web service for submission to the security review - Using the Burp Suite to test a Web Service that is consumed in a Salesforce app. The basic idea is: Have BURP intercept typical requests by acting as a proxy as you browse around the site. If it is Salesforce calling a web service you will need to ...


8

I have faced exactly same problem. Salesforce does not clearly tell you what need to scan and as being SFDC developer we go and scan na1.salesforce.com. Which is not required to scan with Burp. Your development on force.com must be scanned with Force.com Security Source Code Scanner If you are calling out any API from force.com then you should scan those ...


8

Here are your answers: Salesforce has a license to run Checkmarx scanners on premise in order to scan third party code. The code never leaves Salesforce -- it is pulled from the organization in which your code resides to the Checkmarx instances running on our servers. We manage these instances, but it is a Checkmarx scanner engine underneath. Results are ...


8

You are calling a loop with setInterval. This loop will continue to run because it is attached to the window, but the lifecycle of your component is not the life cycle of the window. E.g. if your component is unrendered, say because a user closes the tab in which your component was running, the window object will still be there running that interval long ...


8

Long Story: Quoting examples from apex documentation: // User supplied value: name = Bob // Query string SELECT Id FROM Contact WHERE (IsDeleted = false and Name like '%Bob%') However, what if the user provides unexpected input, such as: // User supplied value for name: test%') OR (Name LIKE ' SELECT Id FROM Contact WHERE (IsDeleted = false AND Name ...


7

During the security review process ,following things are checked 1.Apex code Security best practices .Force.com scanner is good tool to point out any risks 2.All your end points will be BURP Scanned .If your application makes a call to external SAP url ,even SAP URL will be BURP Scanned to discover any potential threats .Note for partners BURP Scanner is ...


7

I assume you are asking what you need to do about this item flagged in the security review. Apex code - such as a controller - does not automatically respect the CRUD settings of the user's profile. You have to add explicit code that checks attributes such as isAccessible and isCreatable from the DescribeSObjectResult API. The aim is to get your Visualforce ...


7

My solution for determining the users email address is going to be to make a SOQL query to the sObject 'User' immediately after the OAuth flow completes. Is there something similar I can do for namespace prefix? Yes, since Spring `16 you can query Organization.NamespacePrefix in SOQL. SELECT NamespacePrefix FROM Organization It's a bit more work, but you ...


6

Yes you do have to submit your application for security review; all apps must be vetted to ensure they're not a potential risk to customers' data. For free apps the review is free, currently it's $2700 for paid applications.


6

Burp is software that does security scanning on web applications. The goal of the software is to find security vulnerabilities. Salesforce provides partners a security scan once a year. If you are not a salesforce partner, you could buy the software yourself. To qualify as a salesforce partner and use the Burp Scanner you must: Be enrolled in the ...


6

Salesforce support has tools to undo a managed package release. They do this by converting you "managed - released" package into a "managed - beta" which undoes the locking with newly added components. There is one major prerequisite before they can do this: the version you want to un-release needs to be uninstalled from ALL organizations. This can pose a ...


6

You cannot pass security review with classes marked as without sharing, the security scanner will always report these files as being a security violation. Without Sharing gets flagged by the security scanner because you can write code that disregards the organizations security model with it. It's important to only use without sharing when absolutely ...


6

In order to pass the security review, every controller or controller extension must have 'with sharing'. There are no exceptions to this. However, if you need to perform some privileged action (and there is a valid business reason for this), then you can make a helper class with an explicit 'without sharing' declaration, and call the helper class from your ...


6

If you want to be cautious, you can check that it is an actual field first. Possibly easier to sanitize input than enforce namespace. public static List<Contact> safeQuery(MyCustomSetting__c setting, String filterValue) { SObjectField field = SObjectType.Contact.fields.getMap.get(settng.Filter_Field__c); if (field != null && field....


6

If your component's init action invokes an server-side method which queries(i.e Read) records, then you are fine. For example : <aura:handler name="init" value="{!this}" action="{!c.initializeComponent}"/> Controller.js ({ initializeComponent: function(component, event, helper) { // api request to my external endpoint var ...


6

Well your assumption about call will be always made by Admin user is not 100% correct. In fact any user can oAuth. So from salesforce standpoint it may happen that user have permission for oauth but no permissions on fields. so to fix this you will need to check in apex To check the field-level update permission of the contact's email field before ...


6

You can use JSENCODE in tandem with the built-in Javascript method JSON.parse. var myEscapedObject = JSON.parse("{!JSENCODE(serializedOptions)}");


6

For a single field as a string, if you know the sObjectType as a string also, you can do: public static Boolean isAccessible(String sObjectType, String fieldName) { SObjectType schemaType = Schema.getGlobalDescribe().get(sObjectType); Map<String, SObjectField> fields = schemaType.getDescribe().fields.getMap(); DescribeFieldResult ...


6

You don't need to check every field that you query. The issue really boils down to who manages security for the field -- your app or the admin. With standard objects, the answer is always the admin. With custom objects, it depends on whether the field is user visible and is used by users or whether it is internal and used only by your app. Things like wizard ...


6

If this is really a label as you describe, then this is a false positive. However you may have left something out of your description. If you could please send me a message with the details of the issue -- it's enough to get the name of the App if this is for the review -- then I can look into it.


6

There shouldn't be any problem; after all, the REST API won't give users any more access than they'd have in the UI (e.g. you can't query records you couldn't view in the UI, etc). They will, of course, make sure you're not making callouts to other orgs/systems or otherwise leaking data you shouldn't, but using any of the APIs are normally fair game as long ...


6

One further observation is that dynamic SOQL does support simple (not dotted expressions or method calls) bind variables that also protect against SOQL injection. So for some dynamic SOQL cases you can use do something like this: String nameLike = '%' + nameSearchField +'%'; String query = 'select ... from ... where Name like :nameLike'; that is a ...


6

To help others who end up here, my response as an answer: From what you posted, looks like a false positive - so I would document it in review. Here is a link to a recent update from the SR team about how to document your false positives As much as anything, the team is looking for you to show awareness of implementing security on the platform, so if you ...


5

You do not need to rewrite the code to eliminate scanner false positives -- there will always be false positives. However, if you want to rewrite the code, then you can replace a boolean with a text literal and then cast to a Bool. <script> var foo = Boolean('{!JSENCODE(IF(MyObject__c.chk_CheckboxField__c,"true", "false"))}'); //absurd way to quiet ...


5

I personally didn't find much value in it. It was mostly done to satisfy the certification requirements. Burp as a tool doesn't seem well suited to testing web services vulnerabilities. It is more focused on the web sites/applicaitons. In my case there was a medium level warning about a possible XML injection risk as the web service was sending back a ]]&...


Only top voted, non community-wiki answers of a minimum length are eligible