Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

The CheckMarx security scanner says that this line is a Reflected XSS vulnerability.

<apex:outputText value="0,number,#,##0.00}" style="color:!nost.balColor};">

However this page


says that <apex:outputText/> is filtered to prevent XSS vulnerabilities. Is that a false positive?


share|improve this question

1 Answer 1

up vote 3 down vote accepted

The 'Reflected' part of reflected XSS vulnerabilities usually means that a parameter going into the page is being echoed back in the response exactly as is, the issue being that if an attacker were to put JavaScript into the parameter it'd end up on the page and being executed by the user's browser.

Given that in this particular case you're outputting a number on to the page, and that JavaScript in the parameter would most likely throw an exception, I believe you're safe to call this a false positive.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.