FAQ-000757 - Development and Sample Code Security / Sample Code Vulnerability Discussion and Reporting

Current Status:VALID_RESPONSEErrorUnable to AnswerSuggests Case

Current FAQ

Question
How can I discuss, justify, or handle security findings related to sample, demonstration, or example code vulnerabilities?
Answer
To discuss potential vulnerabilities in sample code and handle security findings related to demonstration or example code for the AppExchange Security Review: **General Approach:** - Ensure all sample, example, or demonstration code follows the same security standards as production code - Replace insecure elements (e.g., direct DOM manipulation like `document.createElement`) with secure alternatives, such as template directives or protected custom metadata settings - Securely store or remove any sensitive data in the example code - Avoid insecure practices like exposing user session IDs or storing sensitive information in unprotected locations **Justifying False Positives:** To justify that "Sample Code in Production Vulnerability" findings are false positives: 1. **Location**: Clearly identify where the flagged code is located 2. **Explanation**: Provide a detailed rationale explaining why the code does not pose a security risk. For example, clarify that the sample code is strictly for educational or testing purposes and is not used in production 3. **Special Use Cases**: If there are any unique circumstances or exceptions, include them to validate the safety of the flagged code 4. **Documentation**: Include detailed explanations in the false positives documentation, such as the target URL, class name, location, and justification for why the issue is not a security risk 5. **Document Thoroughly**: If flagged findings are not exploitable or relevant to actual functionality, document them as false positives with comprehensive explanations **Additional Resources:** - For further guidance, you can schedule a technical office hours appointment with the Product Security team through the Partner Security Portal - Make sure your documentation is thorough and follows the false-positive reporting guidelines to help the security review team assess your justification Let me know if you need further assistance!
Enhancing FAQ...

Enhancing FAQ with AI recommendations...

AI Recommended Enhancement

Related Security Rules (click to view)
AvoidCreateElementScriptLinkTagAvoidUnescapedHtmlInAura@lwc/lwc/no-inner-htmlVfUnescapeElApexXSSFromEscapeFalseApexXSSFromURLParamAvoidHardCodedCredentialsInAuraAvoidHardcodedCredentialsInFieldDeclsAvoidHardcodedCredentialsInVarDeclsAvoidApiSessionIdAvoidUnauthorizedApiSessionIdInApexAvoidUnauthorizedGetSessionIdInApex
Question
How can I discuss, justify, or handle security findings related to sample, demonstration, or example code vulnerabilities?
Recommended Answer Update
To discuss potential vulnerabilities in sample code and handle security findings related to demonstration or example code for the AppExchange Security Review: **General Approach:** - Ensure all sample, example, or demonstration code follows the same security standards as production code - Replace insecure elements (e.g., direct DOM manipulation like `document.createElement`) with secure alternatives, such as template directives or protected custom metadata settings - Securely store or remove any sensitive data in the example code - Avoid insecure practices like exposing user session IDs or storing sensitive information in unprotected locations **Justifying False Positives:** To justify that "Sample Code in Production Vulnerability" findings are false positives: 1. **Location**: Clearly identify where the flagged code is located 2. **Explanation**: Provide a detailed rationale explaining why the code doesn't pose a security risk. For example, clarify that the sample code is strictly for educational or testing purposes and isn't used in production 3. **Special Use Cases**: If there are any unique circumstances or exceptions, include them to validate the safety of the flagged code 4. **Documentation**: Include detailed explanations in the false positives documentation, such as the target URL, class name, location, and justification for why the issue isn't a security risk 5. **Document Thoroughly**: If flagged findings aren't exploitable or relevant to actual functionality, document them as false positives with comprehensive explanations **Additional Resources:** - For further guidance, you can schedule a technical office hours appointment with the Product Security team through the Partner Security Portal - Make sure your documentation is thorough and follows the false-positive reporting guidelines to help the security review team assess your justification Let me know if you need further assistance!
Reasoning
The FAQ content is accurate and well-structured, so only minor wording improvements were made to align with the conversational tone guidelines. Changed formal contractions like 'does not' to 'doesn't', 'is not' to 'isn't', and 'are not' to 'aren't' to make the text more conversational and natural. These changes maintain all the original technical content and structure while improving readability. Regarding security rules selection: This FAQ directly addresses sample code vulnerabilities and how to handle security findings, which relates to multiple security scanner rules: - AvoidCreateElementScriptLinkTag: The FAQ mentions 'direct DOM manipulation like document.createElement' as an insecure practice to replace - AvoidUnescapedHtmlInAura, @lwc/lwc/no-inner-html, VfUnescapeEl, ApexXSSFromEscapeFalse, ApexXSSFromURLParam: The FAQ discusses general vulnerability patterns that sample code should avoid - AvoidHardCodedCredentialsInAura, AvoidHardcodedCredentialsInFieldDecls, AvoidHardcodedCredentialsInVarDecls: The FAQ mentions 'storing sensitive information in unprotected locations' and 'securely store or remove any sensitive data' - AvoidApiSessionId, AvoidUnauthorizedApiSessionIdInApex, AvoidUnauthorizedGetSessionIdInApex: The FAQ specifically mentions 'exposing user session IDs' as an insecure practice to avoid
Reasoning References