How to resolve Stored XSS issue in salesforce security scan result?

Question

Below is the example code for this issue

<apex:OutputText value="{!question.selectedVal}" escape="false"/>

We cannot remove the escape false because we need to show the HTML content. How to pass security review for this code?

Answer 1

In order to resolve this issue you will need to change the code as below

<apex:OutputText value="{!question.selectedVal}" escape="false"/>

To

<apex:outputPanel id="richtextelement"/>
<script>var richtextelement = document.getElementById('{!$Component.richtextelement}'); $(richtextelement).html($('<div/>').html('{!JSENCODE(question.selectedVal)}').html());</script>