I have the following line of code in my visualforce controller.

caseId = ApexPages.currentPage().getParameters().get('caseId');

I am using PMD, which is a static code analyzer. It complains me of ApexXSSFromURLParam: Apex classes should escape/sanitize Strings obtained from URL parameters.

I studied a bit on this and found that String.escapeSingleQuotes is a useful way to avoid SOQL injection attacks. So I rewrote it as follows:

caseId = String.escapeSingleQuotes(ApexPages.currentPage().getParameters().get('caseId'));

But PMD is still complaining me about the same issue.

Is there anything else that I need to do in order to escape/sanitize the string?

  • which version of PMD are you on? – cropredy Sep 30 '18 at 3:54
  • PMD version: 5.8.0 – Sohan Shirodkar Sep 30 '18 at 5:46
  • hmm, I'm using PMD 6.3.0 w/ruleset 2.0.0 and with a sample class with your line of code, I do not get that inspection error – cropredy Oct 2 '18 at 1:57
caseId = ApexPages.currentPage().getParameters().get('caseId').escapeHtml4();

I had a similar issue with String.escapeSingleQuotes() and this resolved it. Hope this helps.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.