XSRF issue in security review..?

Question

I am getting these from URL..when i submitted my app for security review. their report has XSRF error

can some help me how to correct this...as i need to oid from the url.i could find any alternate solution.i am getting the parameters from force.com site... can some one suggest me the solution...

Map<String,String> parameters=ApexPages.currentPage().getParameters();
orgId = parameters.get('oid');
Call_Back__c obj = new Call_Back__c(Code__c=code,Customer_Org_Id__c=orgId);
upsert obj Customer_Org_Id__c;

Answer 1

First, I'd highly recommend taking advantage of the security team's office hours. They are extremely helpful and also respond to emails with questions in a quick manner.

Couple general ways to deal with XSRF, from easiest to hardest:

• change your page to only take the action after the user clicks on a confirmation-style CommandButton or similar. This goes through the VF native anti-XSRF stuff, and is the easiest solution, but it isn't always appropriate.
• use the SFDC-native, XSRF-resistant stuff like JavaScript remoting or Apex REST.
• manage your own XSRF token. You can do something like generate a long random string and store it in a user-specific custom setting along with a (brief) expiration period. Your page first checks the token against what it expected, and doesn't allow the action to occur if the token doesn't match.

Answer 2

This looks like a Checkmarx result false positive. If so, please send an email to sourcescanner@salesforce.com explaining the issue.