Talk given by Marat Vyshegorodtsev and Sergey Gorbaty. Enterprise Security team at Salesforce, in January 2017. Discusses a set of open source tools that analyze the Apex/VisualForce code and advise on its quality.

1. Finding Security Issues
FAST!
@ser_gor
@MaratVy
Sergey Gorbaty, Marat Vyshegorodtsev
Lead Security Engineers

2. Forward-Looking Statements
Statement under the Private Securities Litigation Reform Act of 1995:
This presentation may contain forward-looking statements that involve risks, uncertainties, and assumptions. If any such uncertainties materialize or if any
of the assumptions proves incorrect, the results of salesforce.com, inc. could differ materially from the results expressed or implied by the forward-looking
statements we make. All statements other than statements of historical fact could be deemed forward-looking, including any projections of product or
service availability, subscriber growth, earnings, revenues, or other financial items and any statements regarding strategies or plans of management for
future operations, statements of belief, any statements concerning new, planned, or upgraded services or technology developments and customer contracts
or use of our services.
The risks and uncertainties referred to above include – but are not limited to – risks associated with developing and delivering new functionality for our
service, new products and services, our new business model, our past operating losses, possible fluctuations in our operating results and rate of growth,
interruptions or delays in our Web hosting, breach of our security measures, the outcome of any litigation, risks associated with completed and any possible
mergers and acquisitions, the immature market in which we operate, our relatively limited operating history, our ability to expand, retain, and motivate our
employees and manage our growth, new releases of our service and successful customer deployment, our limited history reselling non-salesforce.com
products, and utilization and selling to larger enterprise customers. Further information on potential factors that could affect the financial results of
salesforce.com, inc. is included in our annual report on Form 10-K for the most recent fiscal year and in our quarterly report on Form 10-Q for the most
recent fiscal quarter. These documents and others containing important disclosures are available on the SEC Filings section of the Investor Information
section of our Web site.
Any unreleased services or features referenced in this or other presentations, press releases or public statements are not currently available and may not
be delivered on time or at all. Customers who purchase our services should make the purchase decisions based upon features that are currently available.
Salesforce.com, inc. assumes no obligation and does not intend to update these forward-looking statements.

3. Security Tests
in Salesforce
The path from Beginner
to Hardcore
Pass the AppExchange
test in a breeze!
Open sourcing for
everyone
Salesforce
Learning Curve New tools! Future work
Our motivation to
automate

4. The Developer Learning Curve
Apex
VisualForce
Formulas
Custom Objects
~9 hours

5. The Developer Learning Curve
Apex
VisualForce
Formulas
Custom Objects
~9 hours
Lightning
Webservices
APIs
Mobile
~19 hours

6. Apex Enterprise
Security
~11 hours
The Developer Learning Curve
Apex
VisualForce
Formulas
Custom Objects
~9 hours
Lightning
Webservices
APIs
Mobile
~19 hours

7. Apex Enterprise
Security
~11 hours
The Developer Learning Curve
Apex
VisualForce
Formulas
Custom Objects
~9 hours
Lightning
Webservices
APIs
Mobile
~19 hours

8. Clearly a bug
Security reviewers think in three categories
Possibly a bug Clearly not a bug

9. Clearly a bug
Security reviewers think in three categories
Possibly a bug Clearly not a bug
AppExchange Criteria

10. Clearly a bug
Security reviewers think in three categories
Possibly a bug Clearly not a bug
Enterprise Security Criteria

11. Our ultimate motivation
No bugs with (almost) no effort Einstein on a plane

12. How to help ~2 million developers write secure code?

13. Introducing Salesforce-enabled code quality tools

16. Let’s find a bug with PMD help!
public class HotLeads {
public Lead getTopLead() {
return [SELECT … ] ;
}
}

17. Let’s find a bug: Sharing violation
public with sharing class HotLeads {
public Lead getTopLead() {
return [SELECT … ] ;
}
}

18. How we see class sharing definitions
public class MyClass
public without sharing class MyClass
public with sharing class MyClass

19. Let’s find one more bug
public void saveTopLead() {
insert new Lead(firstName='Astro');
}

20. Let’s find one more bug: CRUD and FLS
public void saveTopLead() {
Boolean canCreate =
Schema.sObjectType.Lead.fields.firstName.isCreateable();
if(canCreate){
insert new Lead(firstName='Astro');
}
}

21. How we see CRUD/FLS checks
insert new Lead()
insert new Lead()
// but there are checks for other objects
if(<FLSCHECK>){
insert new Lead()
}

23. A typical VisualForce page layout example
<apex:page>
<script>
var userData = {! userData };
</script>
</apex:page>

24. First attempt on fixing it
<apex:page>
<script>
var userData = {! JSENCODE(userData) };
</script>
</apex:page>

25. Second attempt on fixing it
<apex:page>
<script>
var userData = '{! JSENCODE(userData) }';
</script>
</apex:page>

26. Third and final attempt on fixing it
<apex:page>
<script>
var userData = JSON.parse('{! JSENCODE(userData) }');
</script>
</apex:page>

27. Merging into strings
Similar to Template Strings in ES6
<apex:page>
<script>
var greeting = ' {! ' Howdy, ' + $User.Name }!';
</script>
</apex:page>

28. Merging into strings
Similar to Template Strings in ES6
<apex:page>
<script>
var greeting = ' {! ' Howdy, ' + JSENCODE($User.Name) }!';
</script>
</apex:page>

29. The bright future: linting, autofixing, and CI

30. Already Released
Sending new security rules to pmd
pmd/pmd

31. Future Work: Open Source Projects
acorn-visualforce — JS parser extension to
support VF syntax
eslint-plugin-visualforce — Linter rules for merge
fields
stylelint-visualforce — Linter rules for inline
<style> tags in VisualForce pages