1

I have a visualforce page which creates a lightning component with the with the attributes provided something like this

`

<apex:page cache="false" showHeader="false" sidebar="false" standardController="Account" extensions="AccountController" recordSetVar="accounts" >
    <apex:includeLightning />
    <apex:slds />
    <div id="lightning"></div>
    <script>
        $Lightning.use("c:AccountApp", function() {
            $Lightning.createComponent("c:AssignAccount",{!attributes},"lightning",function(cmp) {                
            });
        });
    </script> </apex:page>

`

and the controller class is

public class AccountController {
private ApexPages.StandardSetController accountSetController;
public List<Id> selectedAccountIds = new List<Id>();
public String listViewId;
public String attributes{get;set;}

public AccountController(ApexPages.StandardSetController standardSetCtrl){
    this.accountSetController = standardSetCtrl;
    listViewId = accountSetController.getFilterId();
    List<Account> accountsSelected = accountSetController.getSelected();
    for(Account a : accountsSelected){
        selectedAccountIds.add(a.Id);
    }
      attributes = JSON.serialize(
      new Map<String, String> {
        'accIds' => String.join(selectedAccountIds, ','),
        'listViewId' => listViewId
      }
    );
    //attributes = '"accIds" : "' + String.join(selectedAccountIds, ',') + '",' + '"listViewId" : "' + listViewId + '"';
}

}

I have a potential vulnerability with the {!attributes} which I have in Lightning.createComponent, when I try to sanitize it with JSENCODE, it breaks the functionality. I tried passing the attributes as a string and JSON none of which removed the vulnerability.

I also tried passing the attributes individually where my controller code was

public class AccountController {
private ApexPages.StandardSetController accountSetController;
public List<Id> selectedAccountIds = new List<Id>();
public Id listViewId {get; set;}
public List<Id> selectedAccounts{get; set;} 

public AccountController(ApexPages.StandardSetController standardSetCtrl){
    this.accountSetController = standardSetCtrl;
    listViewId = Id.valueOf(accountSetController.getFilterId());
    List<Account> accountsSelected = accountSetController.getSelected();
    for(Account a : accountsSelected){
        selectedAccountIds.add(a.Id);
    }     
}

with this VF code

    $Lightning.use("c:AccountApp", function() {
        var params = new Object();              
        params.accIds = "{!selectedAccountIds}";    
        params.selectedListViewId = "{!listViewId}";    
        $Lightning.createComponent("c:AssignAccount",params,"lightning",function(cmp) { 
        });     
        });

None of the approaches resolved the high risk vulnerability. Please provide your insights on this.

1 Answer 1

1

When you use JSENCODE, it adds \ (backslash). Then you can decode it in lightning component on init by using decodeURI(component.get("v.attributes"))

$Lightning.use("c:AccountApp", function() {
        $Lightning.createComponent("c:AssignAccount",{!attributes},"lightning",function(cmp) {                
        });
    });

Change this to

$Lightning.use("c:AccountApp", function() {
        $Lightning.createComponent("c:AssignAccount",{attributes:"{!attributes}"},"lightning",function(cmp) {                
        });
    });

And add attribute with name attributes and type String in c:AssignAccount component

<aura:attribute name="attributes" type="String" />

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .