The CheckMarx security scanner says that this line is a Stored XSS vulnerability.

if(!{!acc.IsActive__c} && reqNDA == 'true' && document.getElementById(elem).checked){

in the following script:

        function checkNDA(elem, reqNDA){
                if(!{!acc.IsActive__c} && reqNDA == 'true' && document.getElementById(elem).checked){
                var confirmNDA = confirm("Please click OK to continue");
                    document.getElementById(elem).checked = false;

Here IsActive__c is a account object checkbox field.

Can someone explain the best way to fix it? or how can I rewrite the script so it does not happen?


UPDATED: Although you cite the field as acc.NDA__c, in the script it looks like a boolean field: acc.IsActive__c. If it's really a boolean (e.g. of boolean type, rather than a string field into which you are passing the text "true" or "false") then you don't need to do anything -- just ignore the scanner, as it's rarely able to reason correctly about field types. Otherwise, do the operation below:

You can't inject variables into a raw javascript context. You can only inject strings. So

  1. Quote the variable
  2. JSENCODE() it to prevent it from breaking out of the quotes and into a JS code context.

For example:

var myval = '{!JSENCODE(acc.NDA__c)}';

Then you can use myval in your code.

If you want to pass other types, first serialize them and then de-serialize them or parse them to the appropriate non-string type.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.