Fix checkmarx report issue Client DOM XSRF

Question

In vfComponent parent.location = self.location; and in checkmarx report it is showing

"component gets a parameter from a user request URL from element location. This parameter value flows through the code and is eventually used to modify database contents. The application does not require renewed user authentication for the request. This may enable Cross-Site Request Forgery (XSRF)."

how to fix this issue.

Answer 1

parent.location = self.location; is used for reloading the page. Since, you are assigning the location, there is a chance that parameters can also be assigned directly which in-turn can modify database record. So, this might be restricted in your checkmarx.

You can instead use below for refresh:

parent.location.reload();