0

Do not know why checkmarx throwing these errors. As there is nothing that needs to be HTMLENCODE. Although VF page showing the data that is being added from Line 344 and 345 from a <apex:selectOptions value="{!OwnerObject}" />.

Object: select
L 344:          for(User u: [select Id,Name from User where isActive = true limit 100]){

Object: Cx_VirtualDal
L 344:          for(User u: [select Id,Name from User where isActive = true limit 100]){

Object: u
L 345:              options.add(new selectOption(u.Id,u.Name));

Object: id
L 345:              options.add(new selectOption(u.Id,u.Name));

Object: string
L 15:     public string strAccOwner{get;set;}

Please help me out of this as i need this to be resolved urgently.

  • What makes you think that you don't need to use HTMLENCODE()? – Derek F Sep 8 '16 at 13:23
2

The scanner is correct, a stored XSS attack is possible from that code. I don't believe this can be handled by HTMLENCODE() in your Visualforce. With that in mind, you probably need to use String.escapehtml4() in your controller to close the hole.

Using User.Id for the value in your SelectOption isn't an issue, but if you were using a text field, some strategically placed double quotes could could end up getting some malicious HTML injected into your Visualforce page.

The bigger issue here is with not HTML-escaping the username, which acts as the label of your SelectOption.

This line in your Visualforce

<apex:selectOptions value="{!OwnerObject}" />

is rendered as

<option value="[User Id here]">[User name here]</option>

A username including "</option>" would then allow someone to inject some malicious HTML.

Try updating the following line in your controller

options.add(new selectOption(u.Id,u.Name));

to

options.add(new selectOption(u.Id,u.Name.escapehtml4()));

If that's not enough, escape the user id as well with String.valueOf(u.Id).escapehtml4()

  • Nice! I thought when I first read it that the option label was Username, and felt sure it was a false positive. Glad you read it more carefully. – Adrian Larson Sep 8 '16 at 13:33
  • Thank you so much @Derek F. You don't know how badly i need this. Thanks to you it passed the checkmarx. Is there anyway i can follow you so that i can learn from your detailed answers? – AKSHAY Dhiman Sep 8 '16 at 16:19
  • @AKSHAYDhiman I don't believe there is any way to follow a particular user, though if you go to a user's profile (click on their name or picture), and go to the Activity page (it's a tab in the upper-left corner, above the profile picture), you can see that user's answers (with the highest rated ones displayed by default). – Derek F Sep 8 '16 at 16:32
  • @AKSHAYDhiman I'm also far from the most knowledgeable here. There are more than a handful of other people here that consistently provide great answers (Adrian Larson, sfdcfox, crmprogdev, Keith C, cropredy, and Daniel Ballinger immediately come to mind). – Derek F Sep 8 '16 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.