"Client Cross Frame Scripting Attack" flagged by Checkmarx scanner

Question

I have a page where the users can click a link which opens a popup window to start the OAuth connection/flow. However this page is getting flagged by the Checkmarx scanner as a possible "Client Cross Frame Scripting Attack".

Here's what the code on my page looks like

<apex:page>

<a href='javascript:;' onClick='initiateConnect()'>Connect</a><br />
<script type="text/javascript">
    var newWindow;
    function initiateConnect() {
      newWindow = window.open("https://login.salesforce.com/services/oauth2/authorize?response_type=code&client_id=my_client_id&redirect_uri=my_redirect_uri", "MyOauth", "location=yes,height=800,width=600,resizable=no,scrollbars=yes,status=yes");
    }
</script>
</apex:page>

Is this code vulnerable to cross frame scripting? If so, any idea how I can make it more secure?

Answer 1

I believe you'd want to use URLENCODE on the link and query params in

newWindow = window.open("https://login.salesforce.com/services/oauth2/authorize
 ?response_type=code&client_id=my_client_id&redirect_uri=my_redirect_uri", "MyOauth",
 "location=yes,height=800,width=600,resizable=no,scrollbars=yes,status=yes");

For more on the subject see Unescaped Output and Formulas in Visualforce Pages and the surrounding sections in the docs.