I am getting an error while security check Category : cross-site scripting , Stored XSS for below

$scope.nameMap = {!nameMap};

For javaScript we have some encoding methos but i didn't found such for angularJS. Please help.

angular script as below:

 <script type="text/javascript">
    angular.module('myApp', ['ui.bootstrap','ui.sortable'])    
          .controller('myTestCtrl', function($scope,$modal,$log,$filter,$interval) {
     $scope.nameMap = {!nameMap};
//...... other variables


Thanks, Rahul

  • I think issue here $scope.nameMap = '{!nameMap}'; here {!nameMap} should be in single quote... and always use angular factory to share the value to controller.. – Ratan Paul Mar 24 '16 at 15:44

You will have to JSENCODE the getter variable ,

$scope.nameMap = '{!JSENCODE(nameMap)}' //If you are expecting just JSON string

If you need to further parse into JSON object use Javascript JSON.parse here

$scope.nameMap = JSON.parse('{!JSENCODE(nameMap)}');

Also try to keep all your script inside static resource as a security best practice and invoke from self executing anonymous function

Ideally for angular ,use Javascript remoting for getting data into $Scope or use VFRemote Objects

  • I tried this, it wont support. – Rahul Mar 24 '16 at 16:09
  • What does it not support ? You will need to encode and hence I would not go with getters and setters and instead use JS remoting for all calls to the backend – Mohith Shrivastava Mar 24 '16 at 16:25
  • I tried using JSENCODE() method to encode angular scope variables. But nothing chnagiing.. Still same giving me security error.. for JAVASCRIPT, its supporting and i resolved error using this only. Not so lucky in case of AngularJS. – Rahul Mar 24 '16 at 16:48
  • @Rahul Try to put all your JS in static resources and scan the VF . – Mohith Shrivastava Mar 24 '16 at 17:06
  • 2
    @MohithShrivastava This answer is almost correct. They're trying to get a native object, not a string, so this should be appropriate: $scope.nameMap = JSON.parse('{!JSENCODE(nameMap)}'); This converts the string into the native object safely. – sfdcfox Mar 24 '16 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.