The CheckMarx security scanner says that this line is a Stored XSS vulnerability.

if(!{!acc.IsActive__c} && reqNDA == 'true' && document.getElementById(elem).checked){

in the following script:

        function checkNDA(elem, reqNDA){
                if(!{!acc.IsActive__c} && reqNDA == 'true' && document.getElementById(elem).checked){
                var confirmNDA = confirm("Please click OK to continue");
                    document.getElementById(elem).checked = false;

Here IsActive__c is a account object checkbox field.

Can someone explain the best way to fix it? or how can I rewrite the script so it does not happen?

1 Answer 1


UPDATED: Although you cite the field as acc.NDA__c, in the script it looks like a boolean field: acc.IsActive__c. If it's really a boolean (e.g. of boolean type, rather than a string field into which you are passing the text "true" or "false") then you don't need to do anything -- just ignore the scanner, as it's rarely able to reason correctly about field types. Otherwise, do the operation below:

You can't inject variables into a raw javascript context. You can only inject strings. So

  1. Quote the variable
  2. JSENCODE() it to prevent it from breaking out of the quotes and into a JS code context.

For example:

var myval = '{!JSENCODE(acc.NDA__c)}';

Then you can use myval in your code.

If you want to pass other types, first serialize them and then de-serialize them or parse them to the appropriate non-string type.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .