The CheckMarx security scanner says that these lines is a Query: XSRF Error

Question

I have a visualforce which is just used to send the Json data when we make a callout to the page with some parameters passed in the URL. Error is showing in the following line. Please help in get through this issue.

<apex:page controller="controllerClass" readOnly="false" contentType="application/json" action="{!StartUpAction}" showHeader="false" sidebar="false" standardStylesheets="false" >

update pm;

In controller method ActionMethod() I am getting the Parameter from the Url and updating an object and then returning the Json.

Here is the code of the Page:

<apex:page controller="GridJSONService" ... action="{!StartUpAction}">
    <apex:outputText escape="false" value="{!Output}" />
</apex:page>

Here is the code of the Controller :

public with sharing class GridJSONService {

    public GridJSONService () { /* constructor */ }

    public void StartUpAction()
    { 
        // intermediate logic
        Planning_Model__c pm = [Select ID,Comments__c from Planning_Model__c where ID =: u_RowId];
        pm.Comments__c = u_Comment;
        update pm;
        // other logic
    }
}

Answer 1

Performing any DML during a page's action method is a security concern. This is because people can cause your code to run without the user's consent. For example, consider what happens if someone puts this HTML into an email, or a page on a website, etc:

<img src="https://na1.visual.force.com/apex/MyPage?id=12345" />

Even though no image will appear, the damage has already been done: your DML was performed by the user without them even knowing anything's happened. At minimum, you should consider calling the method after the page loads. Even better, you should warn the user and give them a chance to back out.

Answer 2

I have fixed the issue. The problem is we cannot use any DML statement in the action method. SO i have moved the DML statements and it passed the checkmarx test.

I have chnaged the controller as follows:

public with sharing class GridJSONService {

public GridJSONService () { /* constructor */ }

public void StartUpAction()
{ 
    // intermediate logic
    Planning_Model__c pm = [Select ID,Comments__c from Planning_Model__c where ID =: u_RowId];
    pm.Comments__c = u_Comment;
    //update pm;
    performDML(JSON.serialize(pm), 'true');
    // other logic
}

@future
public static void performDML(String obj, String isUpdate) {
    if(isUpdate == 'true') {
        update (Planning_Model__c) JSON.deserialize(obj, Planning_Model__c.class);
    } else {
        insert (Planning_Model__c) JSON.deserialize(obj, Planning_Model__c.class);
    }
}

}

This solved the problem.