-
My app was rejected by Salesforce Review with error related to JavaScript.
I sent a small managed packaged app for review in Salesforce Appexchange. However my app was flagged by SFDC Security Review team. The gist of their concern was
“JavaScript of any type is not allowed to run within the Salesforce.com application context. This includes JavaScript blocks within HomePageComponents, WebLinks, and all other components that are run under the Salesforce.com DOM.”The culprit, I think, are short javascript code that we used for weblinks on some buttons. For example we have a button for fetching info of selected records through GETRECORDIDS() , preparing a redirect URL, and open a VF page.
Anyway to get around the problem and get the app listed on AppExchange?
-
1 Reply
-
Though it is not mentioned anywhere explicitly, the managed packaged apps are first tested by automated scripts from Salesforce.com side, and once found, they flag JS code as possible Cross-Site Scripting vulnerability.
Custom Javascript code is always vulnerable to ‘Code Injections’ and are therefore considered a security risk by SFDC. Checkout this post to understand more
https://developer.salesforce.com/page/Secure_Coding_Cross_Site_ScriptingThe problem has a twofold solution. First you have to make sure that you are using proper encoding functions around your JS codes
``Once you have done that, you can request re-review of your app. You would have to convince the review team that your app was flagged a false positive and is not vulnerable.
Log In to reply.
Popular Salesforce Blogs
What Slack and Salesforce Sales Cloud Could Do for Your Business
Today’s customers no longer prefer emails and phone calls. Customers anticipate continuous vendor assistance and participation. This means that reps must spend more time building…
Salesforce Gmail Integration: Seamless Communication
As a continuously growing business and an esteemed Salesforce partner, we know and understand the importance of productivity. Time is a valuable resource that we…
What Are Events In Salesforce Lightning Component
Event Introduction Lightning framework uses event-driven programming Events handle communication between two components. Events are fired from the Javascript controller by using fire() predefined method.…
Popular Salesforce Videos
MailChimp Salesforce Integration
The MailChimp and Salesforce integration allow you to start creating email campaigns from the leads and contacts in your Salesforce CRM. With the integration, it becomes easy to create list segmentation…
Salesforce and Disney Studios Join Forces
Salesforce and Disney Studios Content recently announced a five-year innovation partnership to help support Disney filmmakers and marketers using the Salesforce platform. By naming Salesforce…
Marketing Cloud Connect: Syncing Data Back to Sales and Service Cloud
We demo how to expand the capabilities of Marketing Cloud Connect to automatically sync any data from Marketing Cloud over to Sales and Services Cloud.…
