@W-23895509 | Block secret values in Site preferences - #123
Merged
shauryemahajanSF merged 3 commits intoAug 18, 2026
Merged
Conversation
shauryemahajanSF
changed the title
shauryemahajanSF
force-pushed
the
W-23895509-site-preference-credentials-scan
branch
from
August 17, 2026 19:50
88dc642 to
68933f2
Compare
jbisaSF
reviewed
Aug 18, 2026
jbisaSF
left a comment
jbisaSF
left a comment
Contributor
There was a problem hiding this comment.
The docs/skill updates look good. A couple of gaps in the S20 check itself though. The libxml2-utils install only landed in test-scripts.yml, so the workflows that actually scan CAP zips still don't have xmllint. This PR's security job passed because no zips changed. Also, string-typed secret prefs (the old *ApiKey pattern) currently pass the XML check.
…block string-typed & malformed secret prefs - Install libxml2-utils in security.yml and verify-zip.yml (the workflows that actually scan CAP zips); previously only test-scripts.yml had it, so security-scan.sh would fail closed with "xmllint is required" or S20 would not run in the pipelines that matter. - S20 now matches secret-like attribute IDs on SitePreferences regardless of declared <type>, catching string-typed secrets (e.g. vendorApiKey) that BM will not mask. - S20 fails closed on malformed SitePreferences XML instead of silently skipping the file when xmllint cannot parse it. - Add tests for string-typed secret prefs, non-secret string prefs, and malformed SitePreferences XML. Co-Authored-By: Claude Opus 4.8 (1M context) <claude.noreply@salesforce.com>
jbisaSF
reviewed
Aug 18, 2026
jbisaSF
left a comment
jbisaSF
left a comment
Contributor
There was a problem hiding this comment.
The scanner follow-up looks good. One leftover in the rule list.
jbisaSF
previously approved these changes
Aug 18, 2026
The security-rules.md entry still described S20 as detecting only password-typed Site preferences. The scanner now flags secret-like SitePreferences attribute IDs regardless of declared type and fails closed on malformed SitePreferences XML. Update the rule list to match. Co-Authored-By: Claude Opus 4.8 (1M context) <claude.noreply@salesforce.com>
jbisaSF
approved these changes
Aug 18, 2026
shauryemahajanSF
deleted the
W-23895509-site-preference-credentials-scan
branch
August 18, 2026 18:54
shauryemahajanSF
added a commit
that referenced
this pull request
Aug 18, 2026
Backstop against a wedged ubuntu-latest runner hanging up to the 6h default (as happened on an apt-get step in PR #123). Job-level cap covers all steps, current and future, with no per-step maintenance. Co-authored-by: Claude Opus 4.8 (1M context) <claude.noreply@salesforce.com> Co-authored-by: jbisaSF <jbisa@salesforce.com>
shauryemahajanSF
added a commit
that referenced
this pull request
Aug 18, 2026
Backstop against a wedged ubuntu-latest runner hanging up to the 6h default (as happened on an apt-get step in PR #123). Job-level cap covers all steps, current and future, with no per-step maintenance. Co-authored-by: Claude Opus 4.8 (1M context) <claude.noreply@salesforce.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
getCustomPreferenceValuecallsxmllintand fail closed when the dependency is unavailableTest plan
bash .github/scripts/test-security-scan.sh— 158 passed, 0 failedbash -n .github/scripts/security-scan.sh .github/scripts/test-security-scan.shjq empty .claude/skills/generate-site-preferences-impex/evals/evals.jsongit diff --checkWork item