@W-23895509: Block secret values in Site preferences - #133
Merged
shauryemahajanSF merged 3 commits intoAug 18, 2026
Merged
Conversation
…block string-typed & malformed secret prefs - Install libxml2-utils in security.yml and verify-zip.yml (the workflows that actually scan CAP zips); previously only test-scripts.yml had it, so security-scan.sh would fail closed with "xmllint is required" or S20 would not run in the pipelines that matter. - S20 now matches secret-like attribute IDs on SitePreferences regardless of declared <type>, catching string-typed secrets (e.g. vendorApiKey) that BM will not mask. - S20 fails closed on malformed SitePreferences XML instead of silently skipping the file when xmllint cannot parse it. - Add tests for string-typed secret prefs, non-secret string prefs, and malformed SitePreferences XML. Co-Authored-By: Claude Opus 4.8 (1M context) <claude.noreply@salesforce.com>
The security-rules.md entry still described S20 as detecting only password-typed Site preferences. The scanner now flags secret-like SitePreferences attribute IDs regardless of declared type and fails closed on malformed SitePreferences XML. Update the rule list to match. Co-Authored-By: Claude Opus 4.8 (1M context) <claude.noreply@salesforce.com>
shauryemahajanSF
force-pushed
the
shaurye.W-23895509.site-preference-scan-26.9
branch
from
August 18, 2026 19:24
44c55dd to
1c1b60d
Compare
shauryemahajanSF
marked this pull request as ready for review
August 18, 2026 19:27
shauryemahajanSF
deleted the
shaurye.W-23895509.site-preference-scan-26.9
branch
August 18, 2026 19:27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Forward-port of #123 (which targets
release/26.8) intorelease/26.9. Cherry-picked its three commits; applied cleanly.Adds the S20 security-scan rule that blocks storing/reading authentication secrets in Site preferences, plus the follow-up review fixes:
security-scan.sh: flags secret-likeSitePreferencesattribute IDs (API keys, secrets, passwords, credentials,*Token) regardless of declared type, and same-line literalgetCustomPreferenceValue(...)reads. Fails closed on malformedSitePreferencesXML.libxml2-utils(xmllint) insecurity.yml,verify-zip.yml, andtest-scripts.yml— the jobs that actually run the scanner.test-security-scan.shcovers password-typed, string-typed, non-secret, and malformed-XML cases. Full suite passes 162/0.Why
Merchants/ISVs were storing API keys and tokens in Site preferences (unmasked in BM). This gates that at submission and steers apps to ecom service credentials /
LocalServiceRegistry.🤖 Generated with Claude Code