I have a visualforce which is just used to send the Json data when we make a callout to the page with some parameters passed in the URL. Error is showing in the following line. Please help in get through this issue.

<apex:page controller="controllerClass" readOnly="false" contentType="application/json" action="{!StartUpAction}" showHeader="false" sidebar="false" standardStylesheets="false" >

update pm;

In controller method ActionMethod() I am getting the Parameter from the Url and updating an object and then returning the Json.

Here is the code of the Page:

<apex:page controller="GridJSONService" ... action="{!StartUpAction}">
    <apex:outputText escape="false" value="{!Output}" />
</apex:page>

Here is the code of the Controller :

public with sharing class GridJSONService {

    public GridJSONService () { /* constructor */ }

    public void StartUpAction()
    { 
        // intermediate logic
        Planning_Model__c pm = [Select ID,Comments__c from Planning_Model__c where ID =: u_RowId];
        pm.Comments__c = u_Comment;
        update pm;
        // other logic
    }
}
  • can you share the method code. I am sure that we can't direct access data from parameter. You need to encode them. – Tushar Sharma Sep 27 '16 at 12:20
up vote 5 down vote accepted

Performing any DML during a page's action method is a security concern. This is because people can cause your code to run without the user's consent. For example, consider what happens if someone puts this HTML into an email, or a page on a website, etc:

<img src="https://na1.visual.force.com/apex/MyPage?id=12345" />

Even though no image will appear, the damage has already been done: your DML was performed by the user without them even knowing anything's happened. At minimum, you should consider calling the method after the page loads. Even better, you should warn the user and give them a chance to back out.

  • I have updated the question with the VF Page code and Controller code. – AKSHAY Dhiman Sep 27 '16 at 14:36

I have fixed the issue. The problem is we cannot use any DML statement in the action method. SO i have moved the DML statements and it passed the checkmarx test.

I have chnaged the controller as follows:

public with sharing class GridJSONService {

public GridJSONService () { /* constructor */ }

public void StartUpAction()
{ 
    // intermediate logic
    Planning_Model__c pm = [Select ID,Comments__c from Planning_Model__c where ID =: u_RowId];
    pm.Comments__c = u_Comment;
    //update pm;
    performDML(JSON.serialize(pm), 'true');
    // other logic
}

@future
public static void performDML(String obj, String isUpdate) {
    if(isUpdate == 'true') {
        update (Planning_Model__c) JSON.deserialize(obj, Planning_Model__c.class);
    } else {
        insert (Planning_Model__c) JSON.deserialize(obj, Planning_Model__c.class);
    }
}

}

This solved the problem.

  • So basically the already posted answer addressed your problem? It would be more useful to the community if you instead accept that answer by clicking on the check mark/tick to the left of the answer, turning it green. This marks the question as resolved to your satisfaction, and awards reputation both to you and the person who answered. – Adrian Larson Sep 28 '16 at 13:38
  • 1
    marked the answer as solved. Thank you @sfdcfox. – AKSHAY Dhiman Sep 28 '16 at 13:43
  • 1
    Now the answer is complete as i have mentioned the perfect solution which solved the problem(by using future method). – AKSHAY Dhiman Sep 29 '16 at 10:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.