4

I have an @remoteaction method that returns a list of custom objects and respective child objects. On client I am using AngularJS to display this array. Since it's a remoteaction Salesforce will automatically return the response as JSON, no need to serialize. My challenge is that the response contains encoded characters. For example, ampersands are getting returned as &amp, I need just the ampersand. My JSON payload can be fairly large at times so I am reluctant to do a lot of extra processing to replace these encoded characters with their decoded values. Is there a way to simply and efficiently pass the JSON without the encoded characters?

Here is my remote method

@remoteaction
global static List<DealerPlanning__c> getDealerPlans(String year)
{
    List<DealerPlanning__c>dpList = [SELECT id, name,Account__r.name,Account__r.Aw__c,Account__r.Site,ApprovalStatus__c,ApprovalStatusWithQuarter__c,ApprovalRejectionDate__c, planyear__c,CountofInitiatives__c,
                                            QualityAndExecution__c,BusinessObjective__c,Strengths__c,Weaknesses__c,Opportunities__c, Threats__c,Rating__c,
                                            (SELECT id, name,Initiative_Name__c,Status__c,TargetStartMonth__c,Initiative_Details__c,TargetMonthNumber__c,Dealer_Planning__r.ApprovalStatus__c
                                        FROM Dealer_Initiatives__r)
                                    FROM DealerPlanning__c  
                                    WHERE Account__r.ownerid=:userinfo.getUserId()
                                        AND planyear__c =:year];

    return dpList;
}

Here is the method call

var initDealerPlans = function()
    {
        Ctlr_DealerPlanWorkspace.getDealerPlans('2016',
        function(result, event) 
        {
            if (event.status) 
            {
                console.dir(result);
                $scope.dealerPlans = result;
                $scope.planYear = '2016';
                $scope.$apply();
            }
        });
    }
    initDealerPlans();

Here is sample output.

Showing encoded characters

Any assistance would be greatly appreciated.

Thank you

Jason

1 Answer 1

10

The RemoteAction framework auto-escapes the results by default, to prevent accidental XSS injections for developers using innerHTML to render the contents of a callback. This is a security feature, and should not be disabled without considering the consequences.

However, most frameworks, such as AngularJS, also have a built-in auto-escaping feature that prevents XSS injections, meaning that it is not necessary to have the RemoteAction framework escape the results for you. In order for everything to come out looking just right, while not having any security vulnerabilities, you only ever need exactly one auto-escape function active at one time.

When you are using a framework that has auto-escape features, you need to set the escape=false for the remoting method so the text is not escaped:

var initDealerPlans = function()
    {
        Ctlr_DealerPlanWorkspace.getDealerPlans('2016',
        function(result, event) 
        {
            if (event.status) 
            {
                console.dir(result);
                $scope.dealerPlans = result;
                $scope.planYear = '2016';
                $scope.$apply();
            }
        }, {escape : false};
    }

https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_js_remoting_configuring_request.htm

escape - boolean - Whether to escape the Apex method’s response. The default is true.

3
  • Hi, Eric. While your answer was correct, I felt a bit of an explanation was in order regarding the security aspect of what the escape parameter does. Please feel free to adjust to your liking.
    – sfdcfox
    Dec 27, 2016 at 2:39
  • @sfdcfox - Much appreciated. How you and your family are well....
    – Eric
    Dec 27, 2016 at 2:42
  • 4
    Thanks, Eric! We're doing well, and I'm looking forward to new and exciting stuff in 2017. I hope the holidays are well for you and yours, as well!
    – sfdcfox
    Dec 27, 2016 at 2:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .