Prevent Secure Coding Violations | ISVforce Guide

All solutions listed on AgentExchange must adhere to these AgentExchange security requirements. Learn which violations are most likely to appear in AgentExchange solutions, why they pose security risks, and how to create a solution that helps avoid them.

Load JavaScript Files from Third-Party Endpoints
Avoid dynamically loading third-party JavaScript files from content delivery networks (CDNs). Instead, load the code from the static resources folder of your package.
Load Third-Party CSS in Lightning Components
Include cascading style sheets (CSS) and other resources in static resources rather than loading from a third party.
Use CSS Outside Components
The Salesforce Platform tries to ensure that each namespace is an isolated sandbox, but isolation can’t always be guaranteed. Where a namespace isolation breach occurs, one component can steal clicks from another component, or otherwise interfere with another component’s intended use. To prevent this type of abuse, don’t use CSS directives known to be incompatible with style isolation in your components.
Running JavaScript in the Salesforce Domain
JavaScript code from multiple vendors can run in the same origin. To prevent code interference, vendor JavaScript code is sandboxed. Don’t attempt to break out of a sandbox or run code outside your origin. Use Visualforce, Aura, or Lightning Web Components, which run in the proper origin.
Expose Secret Data When Debugging
In production environments, logging secret data with debug statements is a security vulnerability. Don’t log secret data, sensitive information, passwords, keys, or stack traces in production environments. Redact the data or omit it from the logs.
Store Sensitive Data Insecurely
Follow enterprise security standards when you export data from the Salesforce Platform and when you store secret data in the platform.
Using Software That Has Known Vulnerabilities
Using software that has documented common vulnerabilities and exposures (CVE) related to your use cases is a security vulnerability. If your solution has known vulnerabilities, test and deploy security patches as soon as they’re available. If your solution uses software that has CVE-documented vulnerabilities unrelated to your use cases, prepare false positive documentation.
Use Sample Code in Production
Only use sample code as an educational tool in preparation for developing your own application. When building your production code, always write the code yourself. Avoid copying code from sources that you don’t directly control.
Bypass Object-Level and Field-Level Access Settings
Design your solutions to enforce the org’s create, read, update, and delete (CRUD) and field-level security (FLS) settings on standard and custom objects.
Bypass Sharing Rules in Apex
Respect profile-based permissions, field-level security, sharing rules, and org-wide defaults in your Apex code.
SOQL Injection Due to Insecure Database Query Construction
To prevent Salesforce Object Query Language (SOQL) injection, use bind variables and input sanitation.
Cross-Site Request Forgery
A cross-site request forgery (CSRF) is an attack that forces an end user to execute unwanted actions during their authenticated web application session. To protect against CSRF, use confirmationTokenRequired, or trigger state changes with user actions.
Open Redirects
An open redirect occurs when an application dynamically redirects to a user-controlled parameter value without any validation. Prevent open redirects by using hardcoded redirects.
Lightning LockerService Disabled
Lightning LockerService is a critical security feature for Lightning code. It provides component isolation that allows code from many sources to execute and interact using safe, standard APIs and event mechanisms. Enable Lightning Locker for AgentExchange packages that contain Lightning components or applications.
Insufficient Escaping in Lightning Components
Each component in a bundle is responsible for sanitizing the input provided to it by parent components, apps, or in URL parameters.
Asynchronous Code in Components
Hackers can manipulate the timing of asynchronous code to produce malicious results. To preserve current execution context, wrap asynchronous function calls or batch actions into a single request.
Secure Communication
Ensure that your solution is reachable exclusively over secure connections such as SFTP and HTTPS. Avoid using HTTP and FTP because these protocols don’t encrypt the information that flows over the internet.