salesforce-policy-guardrails

# Salesforce Policy & Guardrails ## Overview Automated policy enforcement for Salesforce integrations: SOQL injection prevention, API key leak detection, governor limit guardrails, and CI pipeline checks. ## Prerequisites - ESLint configured in project - jsforce TypeScript project - CI/CD pipeline with policy checks - Understanding of Salesforce security model ## Instructions ### Step 1: SOQL Injection Prevention ```typescript // CRITICAL: Never concatenate user input into SOQL strings // BAD — SOQL injection vulnerability async function findAccount(name: string) { return conn.query(`SELECT Id FROM Account WHERE Name = '${name}'`); // User input: "'; DELETE FROM Account; --" // Result: SOQL injection (though Salesforce doesn't support DELETE via SOQL, // user can still extract data with UNION-like techniques) } // GOOD — Escape special characters function escapeSoql(value: string): string { return value .replace(/\\/g, '\\\\') .replace(/'/g, "\\'") .replace(/"/g, '\\"') .replace(/%/g, '\\%') .replace(/_/g, '\\_'); } async function findAccountSafe(name: string) { const safeName = escapeSoql(name); return conn.query(`SELECT Id, Name FROM Account WHERE Name = '${safeName}'`); } // BEST — Use parameterized queries with jsforce // jsforce doesn't have native parameterized SOQL, so always use escapeSoql() // For Apex, use bind variables: // [SELECT Id FROM Account WHERE Name = :accountName] ``` ### Step 2: ESLint Rules for Salesfo...