FAQ-000784 - External Content and Iframe Security / CORS and Cross-Domain Communication

To handle CORS-related security findings for third-party JavaScript libraries, developers should: 1. **Load Libraries from Static Resources**: Ensure that third-party libraries are loaded from static resources within the package instead of external sources. This ensures version control and prevents unauthorized changes or vulnerabilities. 2. **Address Third-Party Site Issues**: If the issue is caused by a third-party site, contact the site to request updates to their configurations, such as discontinuing the use of outdated protocols like TLS 1.0 and TLS 1.1.

The existing FAQ content is accurate and well-structured, so no changes are needed to the answer text. The FAQ addresses legitimate CORS security concerns and provides appropriate guidance. For the related security rules: - **LoadJavaScriptHtmlScript** and **LoadJavaScriptIncludeScript**: These rules detect when JavaScript is loaded from external sources rather than static resources, which directly relates to the FAQ's first recommendation about loading libraries from static resources within the package. - **AvoidCreateElementScriptLinkTag**: This rule identifies dynamic creation of script elements, which is a security concern related to third-party JavaScript loading that the FAQ addresses. - **LibraryWithKnownCriticalSeverityVulnerability**, **LibraryWithKnownHighSeverityVulnerability**, **LibraryWithKnownMediumSeverityVulnerability**, **LibraryWithKnownLowSeverityVulnerability**: These rules from retire.js detect known vulnerabilities in third-party JavaScript libraries, which is exactly what the FAQ is helping developers handle by recommending static resource usage for version control. - **ApexInsecureEndpoint**: This rule detects insecure HTTP endpoints, which relates to the FAQ's mention of third-party sites using outdated protocols like TLS 1.0 and TLS 1.1. - **AvoidDisableProtocolSecurityRemoteSiteSetting**: This rule ensures protocol security isn't disabled in remote site settings, which connects to the FAQ's guidance about addressing third-party site configuration issues including outdated TLS protocols.