0

Recently I have done checkmarx scan and while analyzing it shows me one soql query in controller method and totally unrelated variables in VF page. For example 

Note a: [select id, OwnerId, Owner.Name, body from Note where Id In: recordIdList

is shown as the query from controller and 

{!taskPicklist}

which is totally independent of the above query so I am confused what to do as a fix for this stired XSS issue. Any help will be appreciated.

Improve this question
1
  • The PDF output is often broken, I often ditch it and go straight to the XML. Check if they mangled some files/line numbers?
    – eyescream
    Commented Jan 7, 2014 at 11:36

2 Answers 2

Reset to default
1

When Checkmarx marks an issue as a stored XSS, it means that there was a value that was persisted in your application (stored in the database or in the session), without being validated / sanitized. Later in the code this data is being fetched from the storage and is being printed.

In your code, i assume this code: [select id, OwnerId, Owner.Name, body from Note where Id In: recordIdList fetches a value from the database and this data is later being printed.

I hope this helps, otherwise please send me your code (only the relevant part) and I'll have a closer look. Please send it to [email protected]

Thanks, Amit

Improve this answer
0

We've seen some examples of broken paths before -- e.g. flows that are reported by the scanner that don't make sense from the actual code.

Please send your code and a comment describing this issue to [email protected]

We are always on the lookout for more test cases and can use this to improve the scanner. On the other hand, these types of issues may be the result of a bug in the engine and not a bug in the ruleset, in which case it may not be an easy fix. In any case it's worth reporting this issue.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .