FAQ-000228 - CSRF and DML Security Issues / Security Review and Documentation

Current Status:SUGGESTS_CASEErrorUnable to AnswerSuggests Case

← Back to List View Prompt Template

Current FAQ

Question
How can I identify and fix CSRF issues that aren't clearly explained in security review reports?
Answer
To identify and fix CSRF issues that aren't clearly explained in Salesforce security review reports, follow these steps: 1. **Manual Code Review**: Conduct a thorough manual review of your code, focusing on areas where DML operations or sensitive actions are triggered without user interaction. 2. **CSRF Token Implementation**: Ensure all Visualforce pages or components performing sensitive operations include a CSRF token. Set `confirmationTokenRequired=true` for Visualforce pages to mitigate risks. 3. **User Interaction Requirement**: Avoid performing DML operations or sensitive actions on page load. Require explicit user interaction, like a button click, to validate the action. 4. **Authentication and Validation**: Use tokens to authenticate and validate redirections or sensitive actions, ensuring requests originate from legitimate sources. 5. **Entropy Assessment**: Check the complexity of the CSRF token to ensure it cannot be easily guessed. 6. **Testing and Validation**: Use tools like Checkmarx or CodeAnalyzer to identify vulnerabilities, and validate fixes through manual testing to confirm the effectiveness of CSRF mitigation measures. 7. **Documentation and Communication**: If the issue remains unclear, document the steps you've taken to address the vulnerability and raise a case with the Salesforce Security Review Team for further clarification. These steps should help you effectively identify and address CSRF vulnerabilities.

Enhancing FAQ with AI recommendations...

AI Recommended Enhancement

Related Security Rules (click to view)
ApexCSRFVfCsrf
Question
How can I identify and fix CSRF issues that aren't clearly explained in security review reports?
Recommended Answer Update
To identify and fix CSRF issues that aren't clearly explained in Salesforce security review reports, follow these steps: 1. **Manual Code Review**: Conduct a thorough manual review of your code, focusing on areas where DML operations or sensitive actions are triggered without user interaction. 2. **CSRF Token Implementation**: Ensure all Visualforce pages or components performing sensitive operations include a CSRF token. Set `confirmationTokenRequired=true` for Visualforce pages to mitigate risks. 3. **User Interaction Requirement**: Avoid performing DML operations or sensitive actions on page load. Require explicit user interaction, like a button click, to validate the action. 4. **Authentication and Validation**: Use tokens to authenticate and validate redirections or sensitive actions, ensuring requests originate from legitimate sources. 5. **Entropy Assessment**: Check the complexity of the CSRF token to ensure it can't be easily guessed. 6. **Testing and Validation**: Use tools like Salesforce Code Analyzer to identify vulnerabilities, and validate fixes through manual testing to confirm the effectiveness of CSRF mitigation measures. 7. **Documentation and Communication**: If the issue remains unclear, document the steps you've taken to address the vulnerability and raise a case with the Salesforce Security Review Team for further clarification. These steps should help you effectively identify and address CSRF vulnerabilities.
Reasoning
The FAQ content directly addresses CSRF vulnerability identification and remediation, making it highly relevant to both ApexCSRF and VfCsrf security rules. Two minor updates were made to improve clarity and accuracy: (1) Changed 'cannot be easily guessed' to 'can't be easily guessed' for better conversational tone per the brand guidelines, and (2) Updated 'Checkmarx or CodeAnalyzer' to 'Salesforce Code Analyzer' to reference the current, officially supported tool rather than potentially outdated third-party options. These changes maintain all existing content while improving precision and following the conversational tone guidelines. For ApexCSRF rule: This rule detects CSRF vulnerabilities in Apex code, which directly relates to the FAQ's discussion of manual code review (step 1), DML operations without user interaction (step 3), and the overall goal of identifying CSRF issues in security review reports. The FAQ's guidance on requiring explicit user interaction and avoiding sensitive actions on page load directly addresses what the ApexCSRF rule is designed to catch. For VfCsrf rule: This rule specifically targets CSRF vulnerabilities in Visualforce pages, which directly corresponds to the FAQ's step 2 about ensuring Visualforce pages include CSRF tokens and setting confirmationTokenRequired=true. The FAQ's focus on Visualforce-specific CSRF mitigation techniques makes this rule highly relevant to the content being discussed.
Reasoning References