I have a remoting function on my page that takes a list of contacts, and displays them in on Lightning Design styled page. It works fine, but the final innerHTML statement gets flagged in security review as being a DOM based XSS vulnerability. I can't easily use the JSEncode functions, since I using JS Remoting, so trying to work out what I need to do to make this secure in the eyes of the Security Review team?

EDIT Based on this post, sounds like I'd need a client side encoder?

function getEmailTargetList () {


            function(result, event){
                if (event.status) {
                  var outputDiv = document.getElementById("contactList"); 

                  var html = '<div class="slds-scrollable--x"><table id="targetemailcontacts" class="slds-table slds-table--bordered">';    

                  html += '<thead><tr><th scope="col">Action</th>';
                  html += '<th scope="col">Account name</th>';
                  html += '<th scope="col">Contact ID</th></tr></thead><tbody>';    
                  j$.each( result, function(index, value) {
                      html += '<tr><td><button class="slds-button slds-button--neutral slds-m-top--small selectRow" type="button">Select</button></td>';
                      html += '<td>' + value.Account.Name + '</td>';
                      html += '<td>' + value.Id + '</td></tr>';
                  html = html + '</tbody></table></div>';
                  outputDiv.innerHTML = html;

                {escape: false}
  • Is your JS code inside static resource ? Feb 16, 2016 at 19:12
  • 1
    Possibly related to Alternatives for innerHTML in jQuery.
    – Adrian Larson
    Feb 16, 2016 at 19:14
  • 1
    I'd read the problem as being the usage of value.Account.Name. If I was going to attempt a XSS attack on that page I'd try and make an Account name that injects HTML characters. Because it isn't escaped when the HTML is built I could probably get a bold tag or similar injected. From there "All Your Salesforce Are Belong to Us!" Feb 16, 2016 at 19:25
  • 2
    @MohithShrivastava You can at least make it harder with Self-Executing Anonymous Functions. I am surprised usage of global variables isn't flagged as a concern, tbh.
    – Adrian Larson
    Feb 16, 2016 at 19:46
  • 1
    My inclination is to just add this library and be done with it... github.com/SalesforceEng/secure-filters Feb 16, 2016 at 19:49


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.