-
My app was rejected by Salesforce Review with error related to JavaScript.
I sent a small managed packaged app for review in Salesforce Appexchange. However my app was flagged by SFDC Security Review team. The gist of their concern was
“JavaScript of any type is not allowed to run within the Salesforce.com application context. This includes JavaScript blocks within HomePageComponents, WebLinks, and all other components that are run under the Salesforce.com DOM.”The culprit, I think, are short javascript code that we used for weblinks on some buttons. For example we have a button for fetching info of selected records through GETRECORDIDS() , preparing a redirect URL, and open a VF page.
Anyway to get around the problem and get the app listed on AppExchange?
-
1 Reply
-
Though it is not mentioned anywhere explicitly, the managed packaged apps are first tested by automated scripts from Salesforce.com side, and once found, they flag JS code as possible Cross-Site Scripting vulnerability.
Custom Javascript code is always vulnerable to ‘Code Injections’ and are therefore considered a security risk by SFDC. Checkout this post to understand more
https://developer.salesforce.com/page/Secure_Coding_Cross_Site_ScriptingThe problem has a twofold solution. First you have to make sure that you are using proper encoding functions around your JS codes
``Once you have done that, you can request re-review of your app. You would have to convince the review team that your app was flagged a false positive and is not vulnerable.
Log In to reply.
Popular Salesforce Blogs
Apex Trigger In Salesforce - Get Started
The trigger is an apex code that executes before and after the DML operations. Following are the DML operations:- Insert Update Delete Upsert Merge Undelete…
Maximize Your App's Reach: The Ultimate Guide to Listing on Salesforce App Exchange
As you peruse this article on Forcetalks, we are confident that you possess an understanding of Salesforce App Exchange. However, are you aware that this…
5 Things You Need to Know about Salesforce Commerce Cloud
Salesforce Commerce Cloud, formerly known as Demandware, is a robust and scalable cloud-based platform designed to empower businesses with advanced e-commerce capabilities. As an industry-leading…
Popular Salesforce Videos
Salesforce Interface Sends a Command With Parameters to UiPath Assistant Using JavaScript
Salesforce interface sends a command with parameters to UiPath Assistant using Robotjs Code: https://github.com/cristinegulescu/startUiPathFromSalesforce/blob/master/SalesForceLocal.txt
Salesforce Admin Certification 2020 Questions Explained with References - Part I
How to prepare and pass Salesforce Admin Certification with Practice Exam Questions 2020 practice questions and answers for the Salesforce Administration Salesforce Certified Admin Exam…
What Is Salesforce and Why Is It So Good?
Salesforce is by far the most popular CRM tool for sales, support, and marketing teams worldwide. But what exactly is a CRM and why do…
