VfUnescapeEl PMD Fix for VF Page

Question

Can anyone provide your insights for fixing the VfUnescapeEl PMD issue in visualForce Page. For better understanding please see the below code snippet

<script type="text/javascript" src="/canvas/sdk/js/33.0/controller.js" />
<script type="text/javascript">          
//Holds all Operations to be added
var OperationToAdd;
var favoritesToAdd;
var OperationID = "{!ValId}";
var returnURL = "/{!ValId}";      
</script>   </apex:page>

Varibles OperationId and returnURL are having this VFUnescapeEL PMD issue.

Answer 1

The PMD rule VFUnescapeEL is meant to detect potential XSS attacks. Here, you're including data that is likely to be user input (we can't see where ValId comes from) directly in your page's JavaScript content without performing any escaping.

You may find Trailhead's excellent security modules helpful in understanding this kind of attack (I learned a lot). In particular, Salesforce offers routes to neutralize XSS:

To ensure that unsafe characters are properly encoded and aren’t executed by the JavaScript parser, we have to wrap the merge field with the JSENCODE function.

That's what you need to do here: turn {! ValId } into {! JSENCODE(ValId) }. That appears to be what PMD is looking for, based on the source of its rule.