0

When I sent my code to security scan I got Reflected XSS error. How to solve this issue? I wrapped the variable with Jsencode. Visualforce component is not saving. Below is the code where I got that error.

if('{!sfield}' !=''){
 $elem.select2("data", {id: "{!new}", text: "{!sfield}"})  
}
Improve this question
2
  • 3
    Without seeing your code members will guess and might mark unclear what you are asking.
    – Santanu Boral
    Commented Jul 27, 2018 at 10:25
  • I got Reflected XSS Error. At below lines of code if('{!sfField}' !='') { $elem.select2("data", {id: "{!newField}", text: "{!sfField}"}) }
    – SalesforceElearner
    Commented Jul 27, 2018 at 10:34

1 Answer 1

Reset to default
3

Lets first understand what is XSS and see what are the possible ways to prevent this

Cross-site scripting(XSS) is a vulnerability that occurs when an attacker can insert unauthorized JavaScript, VBScript, HTML, or other active content into a web page viewed by other users. A malicious script inserted into a page in this manner can hijack the user’s session, submit unauthorized transactions as the user, steal confidential information

Mechanism provided in VF to Overcome this issue

1)Built in Auto Encoding

All merge-fields are always auto HTML encoded provided they

i)do not occur within a or tag

ii)do not occur within an apex tag with the escape='false' attribute

2)Built in VisualForce encoding functions

The platform provides the following VisualForce encoding functions:

JSENCODE -- performs string encoding within a Javascript String context

HTMLENCODE -- encodes all characters with the appropriate HTML character references so as to avoid interpretation of characters as markup.

URLENCODE -- performs URI encoding (% style encoding) within a URL component context

JSINHTMLENCODE -- a convenience method that is equivalent to the composition of HTMLENCODE(JSENCODE(x))

There is a detailed article in below link

https://developer.salesforce.com/page/Secure_Coding_Cross_Site_Scripting

Sample example

<div onclick="this.innerHTML='Howdy {!Account.Name}'">Click me!</div>

The above is vulnerable

Lets see how we use Encode functions to rectify this

<!-- safe -->
 <div onclick="this.innerHTML='Howdy {!JSENCODE(HTMLENCODE(Account.Name))}'">Click me!</div>

The above is safe since we have use HTMLENCODE AND JSENCODE to encode and hence its hard for attacker to inject script or insert iframe

Edit

For your code try like below

if('{!JSENCODE(sfield)}' !=''){
 $elem.select2("data", {id: "{!JSENCODE(new)}", text: "{!JSENCODE(sfield)}"})  
}

Edit 2

Use the String function to wrap the sfiled because JSENCODE only accepts TEXT

if('{!JSENCODE(String(sfield))}' !=''){
     $elem.select2("data", {id: "{!JSENCODE(new)}", text: "{!JSENCODE(String(sfield))}"})  
    }

Here is the answer that I did refer: - Source

Improve this answer
6
  • I have already tried like that before. It is giving me error "Incorrect argument type for function 'JSENCODE()'. : Markup"
    – SalesforceElearner
    Commented Jul 27, 2018 at 11:41
  • What is the data type of sfield and new field
    – Amit Singh
    Commented Jul 27, 2018 at 13:18
  • public object sfield {get; private set;} private object sfield {get; private set;}
    – SalesforceElearner
    Commented Jul 28, 2018 at 9:30
  • JSENCODE always receives Text Parameters so try to use .valueOf function. Edited the Anwer
    – Amit Singh
    Commented Jul 28, 2018 at 17:04
  • Sorry use String(sfield) to convert into text
    – Amit Singh
    Commented Jul 28, 2018 at 17:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .