When I sent my code to security scan I got Reflected XSS error. How to solve this issue? I wrapped the variable with Jsencode. Visualforce component is not saving. Below is the code where I got that error.

if('{!sfield}' !=''){
 $elem.select2("data", {id: "{!new}", text: "{!sfield}"})  
  • 3
    Without seeing your code members will guess and might mark unclear what you are asking. Jul 27 '18 at 10:25
  • I got Reflected XSS Error. At below lines of code if('{!sfField}' !='') { $elem.select2("data", {id: "{!newField}", text: "{!sfField}"}) } Jul 27 '18 at 10:34

Lets first understand what is XSS and see what are the possible ways to prevent this

Cross-site scripting(XSS) is a vulnerability that occurs when an attacker can insert unauthorized JavaScript, VBScript, HTML, or other active content into a web page viewed by other users. A malicious script inserted into a page in this manner can hijack the user’s session, submit unauthorized transactions as the user, steal confidential information

Mechanism provided in VF to Overcome this issue

1)Built in Auto Encoding

All merge-fields are always auto HTML encoded provided they

i)do not occur within a or tag

ii)do not occur within an apex tag with the escape='false' attribute

2)Built in VisualForce encoding functions

The platform provides the following VisualForce encoding functions:

JSENCODE -- performs string encoding within a Javascript String context

HTMLENCODE -- encodes all characters with the appropriate HTML character references so as to avoid interpretation of characters as markup.

URLENCODE -- performs URI encoding (% style encoding) within a URL component context

JSINHTMLENCODE -- a convenience method that is equivalent to the composition of HTMLENCODE(JSENCODE(x))

There is a detailed article in below link


Sample example

<div onclick="this.innerHTML='Howdy {!Account.Name}'">Click me!</div>

The above is vulnerable

Lets see how we use Encode functions to rectify this

<!-- safe -->
 <div onclick="this.innerHTML='Howdy {!JSENCODE(HTMLENCODE(Account.Name))}'">Click me!</div>

The above is safe since we have use HTMLENCODE AND JSENCODE to encode and hence its hard for attacker to inject script or insert iframe


For your code try like below

if('{!JSENCODE(sfield)}' !=''){
 $elem.select2("data", {id: "{!JSENCODE(new)}", text: "{!JSENCODE(sfield)}"})  

Edit 2

Use the String function to wrap the sfiled because JSENCODE only accepts TEXT

if('{!JSENCODE(String(sfield))}' !=''){
     $elem.select2("data", {id: "{!JSENCODE(new)}", text: "{!JSENCODE(String(sfield))}"})  

Here is the answer that I did refer: - Source

  • I have already tried like that before. It is giving me error "Incorrect argument type for function 'JSENCODE()'. : Markup" Jul 27 '18 at 11:41
  • What is the data type of sfield and new field
    – Amit Singh
    Jul 27 '18 at 13:18
  • public object sfield {get; private set;} private object sfield {get; private set;} Jul 28 '18 at 9:30
  • JSENCODE always receives Text Parameters so try to use .valueOf function. Edited the Anwer
    – Amit Singh
    Jul 28 '18 at 17:04
  • Sorry use String(sfield) to convert into text
    – Amit Singh
    Jul 28 '18 at 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.