1

I have a few places in my code that were flagged as "Stored XSS" and "Reflected XSS" respectively. Here's an example of a "Stored XSS" vulnerability:

Database.query('select Id, Name,
Email from Contact where AccountId=\'' +
String.escapeSingleQuotes(relatedAccountId) + '\' and Contact.Name!=Null
and Contact.Email!=Null');

And here's an example of a "Reflected XSS" vulnerability:

Controller:

originObjectIdString =
string.escapeSingleQuotes(ApexPages.currentPage().getParameters().get('I
d'));

Visualforce page:

'originObjectIdString': '{! originObjectIdString }',

I thought maybe the String.escapeSingleQuotes would help here but apparantly I was wrong - that's only for avoiding SOQL injection attacks. So whats the proper way to escape these sequences to prevent XSS attacks?

1

The reflected XSS is because you will have to encode your variables using JSENCODE ,HTMLENCODE or URLENCODE

'originObjectIdString': '{! JSENCODE(originObjectIdString) }'

Use below ENCODING functions

JSENCODE : To encode the properties in javascript.

HTMLENCODE: To encode the properties in javascript.

JSINHTNLENCODE: If calling a javascript method from HTML component and passing the properties.

URLENCODE: If building a URL on page.

For Stored XSS again if you are passing "relatedAccountId" from UI (VF page) make sure that you check if it is 18 character and data type of Salesforce Id and there is no JS script or malicious script that attacker is passing and if it is just used as internal variable that might false positive .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.