Hi All I am migrating a visual force page to Lightning experience. All this page has is a javascript function which basically sets the height of the frame and calls another JS function. The frame height being set is for an non-SF application which is integrated with our SF application. I did some research, and think see that I have to use JSENCODE. But I am not understanding, where to add JSENCODE? Below is the code for my VF page. Also is there any tool to check if the page is vulnerable to XSS?

<apex:page >
    <script type="text/javascript">
        function onLoad() {
            var params = window.location.search.substring( 1 ).split( '&' );
            var height;
            for( var i = 0, l = params.length; i < l; ++i ) {
                var parts = params[i].split( '=' );
                switch( parts[0] ) {
                    case 'height':
                        height = parseInt( parts[1] );
            if( typeof( height ) == 'number' && parent.parent.parent != null) {
                parent.parent.parent.updateFrameHeightForIntegratedApplication( height );

        window.onload = onLoad;


It's already XSS-proof. You're not merging in anything that could be abused. The only reason you'd want JSENCODE is if you were using a merge field, which you could have:

  function() {
    var height = parseInt( "{!JSENCODE($CurrentPage.parameters.height)}" );
    if(typeof(height) === "number" && parent && parent.parent && parent.parent.parent &&
       parent.parent.parent.updateFrameHeightForIntegratedApplication) {
  • Thanks for your answer. I was thinking the same that there is no merge field so how XSS can happen in this case? I do not know much about how XSS can be done so I thought of double checking if there is any other way for XSS attack through this page.
    – Quest_sfdc
    Aug 24 '18 at 19:22
  • @Quest_sfdc why are you asking, though? Did someone tell you there could be, or are you just being paranoid? XSS requires specific conditions to be met, and there's no such condition here.
    – sfdcfox
    Aug 24 '18 at 19:34
  • you guessed right. I am a little paranoid.
    – Quest_sfdc
    Aug 24 '18 at 19:38
  • May be a dumb question, as per the docs 'All standard Visualforce components, which start with <apex>, have anti-XSS filters in place'. I assume this also covers <apex:iframe>. I ask because for the above code I think the height parameter is coming from the below tag: <apex:pageBlockSection columns="1"> <apex:iframe id="SPASFrame" src="{!launchUrl}" scrolling="true" height="500"/></apex:pageBlockSection>
    – Quest_sfdc
    Aug 28 '18 at 0:15
  • @Quest_sfdc I'm afraid I don't understand your question. You might want to ask a new question with specific details on the behavior you're trying to achieve, the actual behavior you're getting, and all related code that can help us identify your problem.
    – sfdcfox
    Aug 28 '18 at 1:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.