4

I am getting user input through textarea as richtext and storing in object :

<div class="col-md-12">
      <div class="col-md-12">
         <div class="form-group">
            <label>Account Note <span class="required-field-star">*</span></label>
             <apex:inputTextarea id="notes" styleClass="form-control" value="{!object.Field1__c}" richText="true" />
         </div>
     </div>
  </div>

Now, I want to show that text as HTML on page when I use below code it fails in security review and checkmarx.Please suggest how I can display the text as HTML, if I remove escape then it will be printed as it is with HTML tags.

<apex:outputText value="{!object.Field1__C}" escape="false" ></apex:outputText>
  • why don't you use apex:outputfield as this is a standard field ? – Tushar Sharma Jan 30 '16 at 6:36
  • @Tushar - but that will display my html content directly without rendering them as HTML. – Pravesh Mehta Jan 31 '16 at 12:19
  • they will give you desire output.Just try and let me know if you have any issue. – Tushar Sharma Jan 31 '16 at 12:58
  • did you able to solve this problem? – Tushar Sharma Feb 3 '16 at 7:44
  • @Tushar - apex:outputfield needs sobject as input to display content but my content is part of my wrapper class due to which I can't use it as sobject – Pravesh Mehta Feb 3 '16 at 9:10
5
+50

You should not fail the security review because of this, as rich text areas are safe types to render unescaped. Other safe types are listed in the secure coding guidelines. However be aware that what determines the safety of the data type is not the input type in the visualforce page but the data type in your object model. Make sure it's really an RTF type.

I think you may be referring to being flagged by the source scanner as opposed to the security review (which is a manual process). If that is the case, please send an email to sourcescanner@salesforce.com and describe the false positive. There are no guarantees that we can squash every false positive, but we do try to improve the quality of the results over time.

  • 1
    Is it important that if we want to display unescaped HTML ona visualforce page, then it need to come from a rich text area field in tha backend. Does it pose a security risk if it comes from a long text area field. – Prajith Jan 28 '16 at 18:42
  • 3
    @Stygon Yes, if you want to display unescaped HTML, it must come from a RTF or other safe type (such as currency). Long text areas, text areas, and URLs are not safe types. Moreover, if you want to do this, you must store the data in the db and then read it back from the DB before rendering it unescaped. This is because the data is validated/sanitized when it is stored on the backend. If you just assign the data to a safe type in memory then no sanitization occurs. – Robert Sussland Jan 29 '16 at 8:30
0

I think it might be worth looking at this page for your problem

https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_security_tips_scontrols.htm

The scanner is possibly looking for you todo this. We had the same issue in our security checkmarx scanner and we solved it by using correct encoding on stuff.

<apex:outputText value=" {!HTMLENCODE(myTextField)}" escape="false"/>

We also escaped out the details further up in apex for example before we put the variable on the page. This example for script in Javascript see link for HTML

https://developer.salesforce.com/docs/atlas.en-us.200.0.apexcode.meta/apexcode/apex_methods_system_string.htm#apex_System_String_escapeHtml4

https://help.salesforce.com/apex/HTViewSolution?id=000206754&language=en_US

/**
* @author James Knowles 
* @date 27/05/2015
* @group AccountView
* @description Escapes out the name.
*/

public string getEscapedAccountName() {

     String escapedAccountName = '';

     if(acct.account != null)
     {
        escapedAccountName = acct.account.Name;
     }

     return escapedAccountName.escapeEcmaScript(); 
}  

If you follow Checkmarx scanner it normally shows you the flow so you can see points where you could place an escape in.

HTHS

  • 1
    But this equivalent to not using escape='false', since these output fields are automatically htmlencoded unless the escape='false' flag is set. – Robert Sussland Feb 5 '16 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.