-
My app was rejected by Salesforce Review with error related to JavaScript.
I sent a small managed packaged app for review in Salesforce Appexchange. However my app was flagged by SFDC Security Review team. The gist of their concern was
“JavaScript of any type is not allowed to run within the Salesforce.com application context. This includes JavaScript blocks within HomePageComponents, WebLinks, and all other components that are run under the Salesforce.com DOM.”The culprit, I think, are short javascript code that we used for weblinks on some buttons. For example we have a button for fetching info of selected records through GETRECORDIDS() , preparing a redirect URL, and open a VF page.
Anyway to get around the problem and get the app listed on AppExchange?
-
1 Reply
-
Though it is not mentioned anywhere explicitly, the managed packaged apps are first tested by automated scripts from Salesforce.com side, and once found, they flag JS code as possible Cross-Site Scripting vulnerability.
Custom Javascript code is always vulnerable to ‘Code Injections’ and are therefore considered a security risk by SFDC. Checkout this post to understand more
https://developer.salesforce.com/page/Secure_Coding_Cross_Site_ScriptingThe problem has a twofold solution. First you have to make sure that you are using proper encoding functions around your JS codes
``Once you have done that, you can request re-review of your app. You would have to convince the review team that your app was flagged a false positive and is not vulnerable.
Log In to reply.
Popular Salesforce Blogs
Salesforce Classic to Lightning Migration: Benefits and Best Practices
Salesforce is a comprehensive CRM platform that delivers almost everything needed to manage business operations efficiently. It is a powerful toolset that enables top-level management…
A Machine Learning Approach to Deduping Salesforce
When we look at all of the Salesforce deduplication apps on the AppExchange, they all have one thing in common: they are all rule-based. Basically,…
What are Advantages of Hiring a Salesforce Technical Consultant?
If you’re using Salesforce, you need to manage customer relationships better, streamline your operations, and grow your business. But without the right knowledge, it can…
Popular Salesforce Videos
Einstein Analytics – Release Readiness, Spring '18
Discover the new and exciting features that you can expect from Einstein Analytics in the Spring '18 Release. These include: - a new enhanced explorer…
How to Create a Jira Ticket from Salesforce?
Learn how to create a Jira ticket in Salesforce using two different methods and how to choose a Jira project. Know more at https://www.sinergify.com/
How to Create a Salesforce Object Calendar
In this video, we show you how to create a calendar view for any object in Salesforce. This is a feature that can easily help…
