Sign Up ›

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
Fernando Morales OrtizFernando Morales Ortiz 

Built-in XSS Protection unit challenge keeps failing when trying to Check

Hi,

I'm currently working with the "Discover Built-in XSS Protections in Force.com" Unit of Developer Advanced Trail. The point of the challenge is to edit the comments below each use of "{!sampleMergeField1}" to determine if is vulnerable to XSS. 

Based on the criteria found within the unit and in the guidelines in the Secure Coding Cross Site Scripting page for Built in Auto Encoding (All merge-fields are always auto HTML encoded provided they: do not occur within a <style> or <script> tag, AND do not occur within an apex tag with the escape='false' attribute) I came up with the following answers: 
<apex:page controller="Built_In_XSS_Protections_Challenge" sidebar="false" tabStyle="Built_In_XSS_Protections_Challenge__tab">
<apex:sectionHeader title="Built-In XSS Protections Challenge" />
<apex:form >
    <apex:pageBlock >
        <c:Classic_Error />
        <apex:pageMessages />      
        <apex:pageBlockSection title="Demo" columns="1" id="tableBlock">          
            
            <apex:outputText value="{!sampleMergeField1}"/>
            <!-- sampleMergeField1 is vulnerable to XSS: NO -->


            <apex:outputText value="{!sampleMergeField2}" escape="false"/>
            <!-- sampleMergeField2 is vulnerable to XSS: YES -->


            <apex:outputText >
                {!sampleMergeField3}
            </apex:outputText>
            <!-- sampleMergeField3 is vulnerable to XSS: NO -->
       
       
            <style>
                .foo {
                    color: #{!sampleMergeField4};
                }
            </style>
            <!-- sampleMergeField4 is vulnerable to XSS: YES -->
             
            
            {!sampleMergeField5}
            <!-- sampleMergeField5 is vulnerable to XSS: NO -->
            
            
            <script>
                var x = '{!sampleMergeField6}';
            </script>
            <!-- sampleMergeField6 is vulnerable to XSS: YES -->
            
            
            <apex:outputLabel value="{!sampleMergeField7}" escape="false"/>
            <!-- sampleMergeField7 is vulnerable to XSS: YES -->
            
       
        </apex:pageBlockSection>
        <apex:pageBlockSection title="Code links" columns="1">
            <apex:outputPanel >
                <ul>
                    <li><c:codeLink type="Visualforce" namespace="security_thail" name="Built_In_XSS_Protections_Challenge" description="Visualforce Page"/></li>            
                    <li><c:codeLink type="Apex" namespace="security_thail" name="Built_In_XSS_Protections_Challenge" description="Apex Controller"/></li>
                </ul>
            </apex:outputPanel>        
        </apex:pageBlockSection>        
    </apex:pageBlock>          
</apex:form>

But everytime y check the challenge, the same message is displayed:

User-added image

I already checked that I am pointing to the right playground. 

If you can check it and help find where I am going wrong I would be thankful.

Thanks


 
see more...
Best Answer chosen by Fernando Morales Ortiz
Fernando Morales OrtizFernando Morales Ortiz
Apparently, there is a mismatch between the Visualforce Page version of the expected correct result for the challenge and the Visualforce Page version available in the Developer Edition.

It is necessary to change the comments to match the mentioned ones in the Challenge section, and also you must add a new line after the first use of {!sampleMergeField1} to match it to the line 10 (as the Challenge details suggest).

This code passed the challenge: 
<apex:page controller="Built_In_XSS_Protections_Challenge" sidebar="false" tabStyle="Built_In_XSS_Protections_Challenge__tab">
<apex:sectionHeader title="Built-In XSS Protections Challenge" />
<apex:form >
    <apex:pageBlock >
        <c:Classic_Error />
        <apex:pageMessages />      
        <apex:pageBlockSection title="Demo" columns="1" id="tableBlock">    
              
            
            <apex:outputText value="{!sampleMergeField1}"/>
            <!-- Line 10 is vulnerable to XSS: NO -->


            <apex:outputText value="{!sampleMergeField2}" escape="false"/>
            <!-- Line 14 is vulnerable to XSS: YES -->


            <apex:outputText >
                {!sampleMergeField3}
            </apex:outputText>
            <!-- Line 19 is vulnerable to XSS: NO -->
       
       
            <style>
                .foo {
                    color: #{!sampleMergeField4};
                }
            </style>
            <!-- Line 26 is vulnerable to XSS: YES -->
             
            
            {!sampleMergeField5}
            <!-- Line 32 is vulnerable to XSS: NO -->
            
            
            <script>
                var x = '{!sampleMergeField6}';
            </script>
            <!-- Line 37 is vulnerable to XSS: YES -->
            
            
            <apex:outputLabel value="{!sampleMergeField7}" escape="false"/>
            <!-- Line 42 is vulnerable to XSS: YES -->
            
       
        </apex:pageBlockSection>
        <apex:pageBlockSection title="Code links" columns="1">
            <apex:outputPanel >
                <ul>
                    <li><c:codeLink type="Visualforce" namespace="security_thail" name="Built_In_XSS_Protections_Challenge" description="Visualforce Page"/></li>            
                    <li><c:codeLink type="Apex" namespace="security_thail" name="Built_In_XSS_Protections_Challenge" description="Apex Controller"/></li>
                </ul>
            </apex:outputPanel>        
        </apex:pageBlockSection>        
    </apex:pageBlock>          
</apex:form>              
</apex:page>

Thanks.

 
Show 5 answers
Michael MMichael M 

Test class for apex schedulable class__

Hello, Would someone be able to assist in writing a test class for the following apex class:
global class purgeFiles implements Schedulable{
    
    global void execute(SchedulableContext SC) {
        
    List<ContentDocumentLink > docs;
        docs = [SELECT Id, Linkedentity.name, Linkedentity.id,ContentDocument.CreatedDate  
                FROM contentDocumentLink 
                WHERE Linkedentityid 
                IN (SELECT Id FROM lead where createddate < Last_N_Days:7 and isconverted = false) ];  
                //may want to change to include ALL leads
                //AND ContentDocument.CreatedDate < Last_N_Days:7];
                if(!docs.isEmpty())
            delete docs;
    }
}

Thank you very much
see more...
Best Answer chosen by Michael M
AnudeepAnudeep (Salesforce Developers) 
Hi Michael, 

You can start with something like this

@isTest 
public class purgeFilesTest 
{
    static testMethod void testMethod1() 
    {
        List<contentDocumentLink> lstCon = new List<contentDocumentLink>();
         
         Account acc = new Account(name='Test Account');
         insert acc;

         ContentNote n = new ContentNote();
         n.title = 'My Note from Apex';
         insert n;

        for(Integer i=0 ;i <200;i++)
        {
            
            ContentDocumentLink contentlink=new ContentDocumentLink();
            contentlink.LinkedEntityId = acc.id;
            contentlink.ShareType= 'V';
            contentlink.ContentDocumentId=n.id;
            contentlink.Visibility = 'AllUsers';
            lstCon.add(contentlink);
        }
        
         insert lstCon;
       
        Test.startTest();

            purgeFiles obj = new purgeFiles();
            DataBase.executeBatch(obj); 
            
        Test.stopTest();

       // After the testing stops, Please assert if records are updated properly
    }
}

You can learn more about testing batch apex here: 

https://trailhead.salesforce.com/en/content/learn/modules/asynchronous_apex/async_apex_batch

Anudeep
Write an answer or comment...
Yogesh BiyaniYogesh Biyani 

Datetime.format unexpected behavior

I tried the following today in apex anonymous window and I see an unexpected behavior  
System.debug(Datetime.now());
System.debug(Datetime.now().format('YYYY-MM-DD'));
Why id the DD 84 when I use System.debug(Datetime.now().format('YYYY-MM-DD'))?  
13:09:14.1 (2508337)|USER_DEBUG|[1]|DEBUG|2020-03-24 19:09:14
13:09:14.1 (2587013)|USER_DEBUG|[2]|DEBUG|2020-03-84
see more...
Best Answer chosen by Yogesh Biyani
AbhishekAbhishek (Salesforce Developers) 
Hi Yogesh,

I think your query is answered in this blog,

https://salesforce.stackexchange.com/questions/103436/datetime-format-unexpected-behavior

Check it once.

Thanks.
Show 5 answers
Varun Sharma 150Varun Sharma 150 

SOQL to Get All Service Appointments scheduled to Preferred / Required Service Resources

HI,
I am looking to get an SOQL which can help to find all service Appointment which are scheduled to Preferred / Requried Service Resources. I am looking for a SOQL including ServiceAppointment, WorkOrder and WorkType.

 
see more...
Best Answer chosen by Varun Sharma 150
AnudeepAnudeep (Salesforce Developers) 
Hi Varun,

 Can you try something like this? 

SELECT Id, Status, ParentRecordId,ParentRecordType,WorkTypeId FROM ServiceAppointment where Status IN ('Preferred', 'Required Service') AND ParentRecordType = 'Workorder'

User-added image

Anudeep

 
Show 2 answers
Brian Franklin 12Brian Franklin 12 

Can non-developer accounts use a Connected App created under a developer account?

We have created a Connected App in our developer account.  Other developer accounts can connect to it and use it.

Trial accounts can connect to it, but don't by default have API access.

Will Professional users with API access, Enterprise, and Unlimited users be able to use the Connected App specified in our developer account, or do we need to have a paid Salesforce account in which to re-create the Connected App for "production" use?
see more...
Best Answer chosen by Brian Franklin 12
jigarshahjigarshah
Brian,

A connected app is an application that helps an external entity or application connect to Salesforce.com and get access to the data residing within. Connected Apps use OAuth 2.0 as the authentication protocol to authenticate any user or application and provide them with access ot the instance.

To answer your question, YES your Salesforce users from other orgs will be able to access and use the Connected App setup in your Developer Edition Salesforce Org without incurring any additional license cost. A simple analogy to understand this would be to look at Salesforce as a castle which has entry gates called Connected Apps. As long as you are authenticated and allowed through the gates, you have access to the castle.

Your Salesforce users will be using a single set of credentials to access the Salesforce.com instance where the Connected App is setup. Hence, irrespective of the number of Salesforce Users accessing the Connected App, they would still map to a single User account on the target org which can be accessed via the Connected App.You do not need a paid license to access a Connected App specifically as long as you have enough Salesforce User licenses and have the right access configured.

However, I am curious why would you want your Production Salesforce Users access information from a Developer Edition org. Is it a part of a proof of concept that you are implementing?

Please mark the thread as SOLVED and answer as the BEST ANSWER if it helps address your issue.
Show 3 answers
Thomas Thejn 8Thomas Thejn 8 

ReportType: Content is not available

When I try to add content reports to my managed package and install this in Sandbox org I get the following error:  
This app can't be installed.
There are problems that prevent this package from being installed.
(SalesValue_reports/Content_by_class_yrh) ReportType: Content is not available	SalesValue_reports/Content_by_class_yrh: ReportType: Content is not available
I have enabled Content in the Sandbox org, and I can see the option to create reports of the type "File and Content Report". 

Does anybody know what is wrong? 
see more...
Best Answer chosen by Thomas Thejn 8
AnudeepAnudeep (Salesforce Developers) 
Hi Thomas, 

Enabling content seems to be the only solution

Did you also try giving users access to Salesforce CRM Content by assigning feature licenses and verify that the Salesforce CRM Content users have the Salesforce CRM Content user permissions enabled?

https://help.salesforce.com/articleView?id=content_initialsetup.htm&type=5

During the package installation, you will recieve an email with the org Id if there is a failure for example: 

OrganizationId: 00Dxxxxxxxxxxxx
UserId: 005xxxxxxxxxxxx

Subject: Package Install Failure 04ti0000000LHIVAA4
ExtendedMessage: ReportType: Content is not available: ReportType: Content is not available

Ensure you are doing this for the correct org and the user. If the issue still persists, please contact support. Thank You!

Anudeep
 
Show 3 answers
kumquatlilykumquatlily 

Help Needed 2 questions

Appreciate the correct answers for the following PD 1 exam questions and clarification?
My thoughts of answers in Italic.
thanks in advance!

1.  Given the following Anonymous Block:
List<Case> casesToUpdate = new List<Case>();
for(Case thisCase : [Select Id, Status FROM Case LIMIT 50000]){            thisCase.status = 'Working';
    casesToUpdate.add(thisCase);

} try{
       Database.update(casesToUpdate.false);
}catch(Exception e){
      System.debug(e.getMessage()); }

What should a developer consider for an environment that has over 10,000 Case records?
A. The transaction will fail due to exceeding the governor limit.  
B. The try/catch block will handle any DML exceptions thrown.
C. The transaction will succeed and changes will be committed.
D. The try/catch block will handle exceptions thrown by governor limits.

2. A developer has an Apex controller for a Visualforce page that takes an ID as a URL parameter. How should the developer prevent a cross site scripting vulnerability?
A. ApexPages.currentPage() .getparameters() .get('url_param')
B. ApexPages.currentPage() .getParameters() .get('url_param') .escapeHtml4()
C. String.ValueOf(ApexPages.currentPage() .getparameters() .get('url_param'))
D. String.escapeSingleQuotes(ApexPages.currentpages() .getParameters() .get('url_param'))
see more...
Best Answer chosen by kumquatlily
AnudeepAnudeep (Salesforce Developers) 
Hi kumquatlily, 

1. There is a DML Insert/Update Limit of 10,000 rows when running anonymous apex. Based on the code block above, we run into the error - "Too many DML rows: 10001" error when trying to insert/update so the answer would be B based on my knowledge

2. Option D because String.escapeSingleQuotes can be used to prevent attackers from accessing restricted data in the org

https://trailhead.salesforce.com/en/content/learn/modules/secdev_injection_vulnerabilities/secdev_inject_prevent_soql_injection

Kindly let me know if it helps you and close your query by marking it as solved so that it can help others in the future. Thank You!

Anudeep
Show 2 answers
Bill Bell 3Bill Bell 3 

Order of Triggers and Process Builder

New to Salesforce.

I'm creating a fairly complex process in Process Builder on the Opportunity object.  When the record is saved I want to trigger and calculated some dates and do a few other checks to make sure only valid option types are entered.  Therefore, I want Process Builder to run after I do the Save trigger.  I couldn't find any documentation on this.
see more...
Best Answer chosen by Bill Bell 3
UC InnovationUC Innovation
Hi Bill,

Welcome! According to the documentation on Triggers and Order of Execution (https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_triggers_order_of_execution.htm), it looks like what you want to accomplish can be done using the trigger as you mentioned as well as a validation rule(s) to do the checks. You might want to read up on the OOE that might be the direction you want to go in. If I understand your requirements, I believe salesforce already executes in the order that you want it to. This is good news!

Feel free to ask any further questions on the matter. I will be more than happy to help you out.

Hope this helps!

AM
Show 3 answers
AmberTaylorAmberTaylor 

Need Help writting a 100% code coverage test class for Batch

Hi there, 

I'm quite stuck here. 
I've written a test class for my batch but it doesn't appears to be running. It stays at 0% :( 

I'm missing something but don't know what. 

Can someone help me figure it out? 

Here is my batch class :  
global class BatchUpdateAllLeads implements Database.Batchable <SObject> {
//START METHOD
    global Database.QueryLocator start(Database.BatchableContext bc){
        String Query='Select id,TECH_Update__c from Lead where TECH_Update__c=false AND Converted=false ' ;
        return Database.getQueryLocator(Query);
            }
//EXECUTE METHOD
    global void execute(Database.BatchableContext bc, List<Lead> scope){
        for(Lead l: scope){
            l.TECH_Update__c = true;
        }
        update scope;
    }
//FINISH METHOD
    global void finish(Database.BatchableContext bc){
        Id job= bc.getJobId();
        System.debug(job);
    }
}

And this is my attemp of writting a proper test class :(  
@istest
private class BatchUpdateAllLeads_TEST {
    @istest
    static void testAcc(){
        List<Lead> l = new List<Lead>();
        Lead l1 = new Lead(Company	='BTP',LastName = 'Test',SIRET__c='12659991955626',Numero_d_ordre__c='9999-99-99',Region_GRDF__c='Ile de France',Tech_Update__c=false,IsConverted=false);
        l.add(l1);

        Lead l2= new Lead(Company	='Comp',LastName = 'Test2',SIRET__c='12659991955687',Numero_d_ordre__c='1111-99-99',Region_GRDF__c='Ile de France',Tech_Update__c=false, IsConverted=true);
        l.add(l2);

        Lead l3= new Lead(Company	='Agny', LastName = 'Test3', SIRET__c='19959991988687', Numero_d_ordre__c='1111-99-11', Region_GRDF__c='Ile de France', Tech_Update__c=true,IsConverted=true);
        l.add(l3);
        insert l;
   
    Test.startTest();
    BatchUpdateAllLeads ap= new BatchUpdateAllLeads();
    Id jobid= Database.executeBatch(ap);
    Test.stopTest();
    }
}

Ty very much for your help
see more...
Best Answer chosen by AmberTaylor
sachinarorasfsachinarorasf
Hi AmberTaylor ,

Please update your both class Apex Class as well as test class by the following code to achieve 100% Code Coverage.

Apex Class. 
global class BatchUpdateAllLeads implements Database.Batchable <SObject> {
//START METHOD
    global Database.QueryLocator start(Database.BatchableContext bc){
        String Query='Select id,TECH_Update__c from Lead where TECH_Update__c=false AND isConverted=false' ;
        return Database.getQueryLocator(Query);
            }
//EXECUTE METHOD
    global void execute(Database.BatchableContext bc, List<Lead> scope){
        for(Lead l: scope){
            l.TECH_Update__c = true;
        }
        update scope;
    }
//FINISH METHOD
    global void finish(Database.BatchableContext bc){
        Id job= bc.getJobId();
        System.debug(job);
    }
}

Test Class. 
@istest
private class BatchUpdateAllLeads_TEST {
    @istest
    static void testAcc(){
       List<Lead> l = new List<Lead>();
        Lead l1 = new Lead(Company    ='BTP',LastName = 'Test',Tech_Update__c=false,IsConverted=false);
        l.add(l1);

        insert l;
  
    Test.startTest();
    BatchUpdateAllLeads ap= new BatchUpdateAllLeads();
    Id jobid= Database.executeBatch(ap);
    Test.stopTest();
    }
}



I hope you find the above solution helpful. If it does, please mark as Best Answer to help others too.

Thanks and Regards,
Sachin Arora
www.sachinsf.com
Show 5 answers
Jeanette Albert 15Jeanette Albert 15 

Insert failed. First exception on row 0; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id:

Insert failed. First exception on row 0; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id: []
Error is in expression '{!genDoc2}' in component <apex:commandButton> in page doccontrolgather: Class.DocControlQuery.SavePDF: line 203, column 1
Class.DocControlQuery.genDoc2: line 120, column 1


I need help with this apex code.  I am not a coder :-S


 
see more...
Best Answer chosen by Jeanette Albert 15
Michael DsozaMichael Dsoza
YES, Can you please check with permission for the reference field & referenced object.
Thanks
Show 5 answers
Show More