Do not know why checkmarx throwing these errors. As there is nothing that needs to be HTMLENCODE. Although VF page showing the data that is being added from Line 344 and 345 from a <apex:selectOptions value="{!OwnerObject}" />.

Object: select
L 344:          for(User u: [select Id,Name from User where isActive = true limit 100]){

Object: Cx_VirtualDal
L 344:          for(User u: [select Id,Name from User where isActive = true limit 100]){

Object: u
L 345:              options.add(new selectOption(u.Id,u.Name));

Object: id
L 345:              options.add(new selectOption(u.Id,u.Name));

Object: string
L 15:     public string strAccOwner{get;set;}

Please help me out of this as i need this to be resolved urgently.

  • What makes you think that you don't need to use HTMLENCODE()?
    – Derek F
    Sep 8, 2016 at 13:23

1 Answer 1


The scanner is correct, a stored XSS attack is possible from that code. I don't believe this can be handled by HTMLENCODE() in your Visualforce. With that in mind, you probably need to use String.escapehtml4() in your controller to close the hole.

Using User.Id for the value in your SelectOption isn't an issue, but if you were using a text field, some strategically placed double quotes could could end up getting some malicious HTML injected into your Visualforce page.

The bigger issue here is with not HTML-escaping the username, which acts as the label of your SelectOption.

This line in your Visualforce

<apex:selectOptions value="{!OwnerObject}" />

is rendered as

<option value="[User Id here]">[User name here]</option>

A username including "</option>" would then allow someone to inject some malicious HTML.

Try updating the following line in your controller

options.add(new selectOption(u.Id,u.Name));


options.add(new selectOption(u.Id,u.Name.escapehtml4()));

If that's not enough, escape the user id as well with String.valueOf(u.Id).escapehtml4()

  • Nice! I thought when I first read it that the option label was Username, and felt sure it was a false positive. Glad you read it more carefully.
    – Adrian Larson
    Sep 8, 2016 at 13:33
  • Thank you so much @Derek F. You don't know how badly i need this. Thanks to you it passed the checkmarx. Is there anyway i can follow you so that i can learn from your detailed answers? Sep 8, 2016 at 16:19
  • @AKSHAYDhiman I don't believe there is any way to follow a particular user, though if you go to a user's profile (click on their name or picture), and go to the Activity page (it's a tab in the upper-left corner, above the profile picture), you can see that user's answers (with the highest rated ones displayed by default).
    – Derek F
    Sep 8, 2016 at 16:32
  • @AKSHAYDhiman I'm also far from the most knowledgeable here. There are more than a handful of other people here that consistently provide great answers (Adrian Larson, sfdcfox, crmprogdev, Keith C, cropredy, and Daniel Ballinger immediately come to mind).
    – Derek F
    Sep 8, 2016 at 16:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .