0

I have found this issue when I have given my code to Code Scanner

Reflected XSS

This is basically because of two things

    Map<string,string> params =
    ApexPages.currentPage().getParameters();


var validAddress = '{!validAddress}';// it is in VF Page where valid Address is String in apex class

How can I resolve this issue?

Improve this question
3
  • 1
    those code is not enough to figure out what is that issue
    – kurunve
    Commented Jul 20, 2016 at 7:34
  • 1
    but what can I say from this -- try to use JSENCODE and HTMLENCODE to ensure that there are no JS injected in validAddress variable (salesforce.stackexchange.com/a/61377/18189) as well as using escapeSingleQuotes on page parameters to avoid injection there
    – kurunve
    Commented Jul 20, 2016 at 7:37
  • If it is VF page use: var validAddress = '{!JSENCODE(validAddress)}';
    – Liron C
    Commented Mar 15, 2022 at 7:57

1 Answer 1

Reset to default
0

The risk that scanner is alerting you to is that a hacker could put malicious code in a URL parameter. The parameter values (and names, I suppose) are data from an outside source, and should not be trusted.
Because of the legitimate risk, you should implement the suggestions from kurunve above: encode and/or escape the parameters as appropriate for the context that you are using them in.

Improve this answer
1
  • We can't tell what relationship (if any) exists between params and validAddress. Certainly the snippet is not enough to assess if a legitimate vulnerability exists.
    – Adrian Larson ♦
    Commented Jul 20, 2016 at 12:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .