5

You're allowing the attacker to use any arbitrary input, so they can inject extra parameters, etc. I think what the security scanner is looking for is EncodingUtil.urlEncode: String url = '/' + oGenericObj.getDescribe().getKeyPrefix() + '/e'; if (strObject.equals('Quote')) { url += '?oppid=' + EncodingUtil.urlEncode( System....


5

This is a normal part of the content security policy that Salesforce requires. Over the years this has become stricter (as online security tends to do). Mozilla's MDN web documentation on Content Security Policy also considers this a requirement. In that sense there's nothing left to do but place the inline CSS in an CSS file. The reason for this is ...


3

You can either use StripInaccessible or a describe API to make sure you check for FLS. There is a neat blog post that you can adopt some code from. My preference would be to use the StripInaccessible as it consumes less CPU compared to the describe callouts. If you need further assistance, I suggest book an office hour with the security review team at ...


3

I suggest you bring this up in an office hour with the security review team and see what they suggest to be sure that your app won't fail the security review process. Now to answer it, Server to Server invocation Usually, the risk is very low if your connection is secured HTTPS from a theoretical perspective. In theory, an HTTPS connection does encrypt the ...


3

have seen few storages from salesforce Platform Cache and Session Cache, any idea how these works with security review and are these are replaceable for window.sessionStorage? Platform Cache is not a replacement for your stated intention, which is to reduce server calls. It is a technology meant for Apex to reduce CPU usage by avoiding recalculating ...


3

You still need the FLS checks. The reason why is that administrators could choose to create a new Permission Set and allow users access to the code but not the fields for whatever reason, or even edit profiles and add code access directly, without field/object access. Never assume that your subscribers won't accidentally (or even intentionally) create ...


2

You can't use Security.stripInaccessible() and WITH SECURITY_ENFORCED on the same query: SObjectAccessDecision securityDecision = Security.stripInaccessible( AccessType.READABLE, [SELECT Id, Status__c, Service_Appointment__r.Id, Service_Appointment__r.SA_Dispatched_SMS_Status__c FROM SMS__c WHERE Id IN :lstUpsertedSMSRecordIds WITH ...


2

Use of API Sids has never been allowed in managed packages. These are allowed only in unpackaged code. The only issue is that there weren't automated tools in place to consistently enforce this. As these automated tools are rolled out, a lot of apps will start failing the review because of session Id theft and existing apps will start getting flagged. To ...


2

You can try steps mentioned in below link for the oOuth way. Link - https://www.gscloudsolutions.com/blogpost/Using-Named-Credentials-with-the-Apex-Wrapper-Salesforce-Metadata-API-apex-mdapi?blogpost=true This uses connected app, named credentials and auth provider. And it modifies endpoint in MetadataPort class, public class MetadataPort { // Update ...


2

You can't make a Public Custom Setting Protected once you've uploaded it at least once in a "Release" (not "Beta") package version. You will need to follow the directions in Revert a managed package to a beta version to fix this problem, or delete the Custom Setting entirely as outlined in Delete Components from First-Generation Managed ...


2

You can't disable the automatic push feature; it's the same feature that ISVs have had available for years. Publishers tend to take this responsibly seriously though, because if they screw up, it could damage their reputation and potentially have legal consequences. That said, this all involves a certain level of trust. If you don't trust the publisher to do ...


1

Yes, it's possible to pass a Security Review with escape="false". If the scanner flags your code, and you're absolutely certain that it's impossible to perform XSS, CRSF, or other types of injection, you can argue your case with the Security Review Team. Just make sure that your code is actually secure, and they'll allow it.


1

Two points: This is probably a coding practice/style warning which is not relevant to a security review (but that is worth addressing to make your code perform better); Checkmarx never flags all instances of the same issue (if you have many of them) because the report you get from Salesforce Checkmarx execution is truncated and only shows the first n ...


1

No, this would not pass the Security Review, and is inappropriate for a managed package, which should not steal the authentication data of its users. If you want to act on behalf of a user, don't impersonate the user, but ask the user to authorize you to act on their behalf: use an OAuth token with a scope agreed to by the user. It's pretty easy to setup a ...


1

It is generally not in the spirit of OAuth to be passing the client secret around as this is supposed to authenticate the client. But whether your system is exploitable depends on what you are doing. You say the client secret is encrypted -- how? And how is key management handled, and how is that wrapping key stored and distributed? How are you ...


1

You can perform DML if your class has a without sharing Clause. Also, you can display the data on UI if you have a wrapper class. But you can't do so by referring to the object itself. For Example: If you are returning a list of Opportunities from the AuraEnabled apex method, if this method is called in the customer community context, you will run into an ...


1

The explanation for the page to not ignoring your permission when seeing it, is likely what Adrian Larson states in the first comment. However, the explanation for you DMLs resulting in errors when you are not enforcing CUD (note that you are still missing checking the FLS, which should be done) is probably just because of the fact that you are using ...


Only top voted, non community-wiki answers of a minimum length are eligible