-
My app was rejected by Salesforce Review with error related to JavaScript.
I sent a small managed packaged app for review in Salesforce Appexchange. However my app was flagged by SFDC Security Review team. The gist of their concern was
“JavaScript of any type is not allowed to run within the Salesforce.com application context. This includes JavaScript blocks within HomePageComponents, WebLinks, and all other components that are run under the Salesforce.com DOM.”The culprit, I think, are short javascript code that we used for weblinks on some buttons. For example we have a button for fetching info of selected records through GETRECORDIDS() , preparing a redirect URL, and open a VF page.
Anyway to get around the problem and get the app listed on AppExchange?
-
1 Reply
-
Though it is not mentioned anywhere explicitly, the managed packaged apps are first tested by automated scripts from Salesforce.com side, and once found, they flag JS code as possible Cross-Site Scripting vulnerability.
Custom Javascript code is always vulnerable to ‘Code Injections’ and are therefore considered a security risk by SFDC. Checkout this post to understand more
https://developer.salesforce.com/page/Secure_Coding_Cross_Site_ScriptingThe problem has a twofold solution. First you have to make sure that you are using proper encoding functions around your JS codes
``Once you have done that, you can request re-review of your app. You would have to convince the review team that your app was flagged a false positive and is not vulnerable.
Log In to reply.
Popular Salesforce Blogs
Salesforce for Logistics Industry | All You Need to Know
The logistics industry has evolved from just stock-keeping to maintaining a large amount of inventory management and handling of that inventory with Unique IDs related…
Salesforce Postman Integration - A Short Guide
Connected App is provided by Salesforce to connect with the platform from any other application. Getting Started with Salesforce Connected App: Goto Setup, Search for…
Permission Sets in Salesforce - Learn About Its Different Types
A permission set is a collection of settings and permissions that give users access to various tools and features. Permission sets extend users' functional access…
Popular Salesforce Videos
Customer Overview: How Our Customer Used Salesforce Industries i.e Vlocity For It’s Business?
Let's have a glance at our customer success story to understand what is Salesforce Industries in detail. Watch this video and do let us know…
Get Started with Salesforce for Recruitment and Admissions: Admissions and Onbaording
This webinar is designed for Salesforce admins and users who work in Recruitment and Admissions. We will cover all you need to know about using…
Control Access to the Org | Data Security | Salesforce
In this video, wonder Studies explains how to control access to your Salesforce org and the data security measures you can take to protect your…
