I have found this issue when I have given my code to Code Scanner

Reflected XSS

This is basically because of two things

    Map<string,string> params =

var validAddress = '{!validAddress}';// it is in VF Page where valid Address is String in apex class

How can I resolve this issue?

  • 1
    those code is not enough to figure out what is that issue
    – kurunve
    Jul 20 '16 at 7:34
  • 1
    but what can I say from this -- try to use JSENCODE and HTMLENCODE to ensure that there are no JS injected in validAddress variable (salesforce.stackexchange.com/a/61377/18189) as well as using escapeSingleQuotes on page parameters to avoid injection there
    – kurunve
    Jul 20 '16 at 7:37

The risk that scanner is alerting you to is that a hacker could put malicious code in a URL parameter. The parameter values (and names, I suppose) are data from an outside source, and should not be trusted.
Because of the legitimate risk, you should implement the suggestions from kurunve above: encode and/or escape the parameters as appropriate for the context that you are using them in.

  • We can't tell what relationship (if any) exists between params and validAddress. Certainly the snippet is not enough to assess if a legitimate vulnerability exists.
    – Adrian Larson
    Jul 20 '16 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.