I have got the Client Cross Frame Scripting Attack alert in the recent CheckMarx scanner. However, it points to an auto generated ID. enter image description here

I've seen the following links however, the I'm not sure about relavancy of the soluions given i.e.,

  1. Protecting against iframe embedding
  2. Escaping single quotes
  3. Similar Issue with no solution

Regarding my visualforce component, I'm doing just one DML operation on a custom setting from a callout response. Also, I'm not passing any attribute to the component.

To give a background of the component, its just a list view of records from a different system retrieved through a callout on load via JavaScript.

Let me know if in case anything else is needed.

Thanks in Advance! Peace!

1 Answer 1


This looks like a false positive. There are false positives with every query, of course, and we regularly review these queries. Going forward, we are going to remove this query from our security preset.

  • Thanks for the clarification. Will mark as answered once the security review is cleared. Thanks! Commented Jul 27, 2016 at 5:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .