There is the following section in the SFCC documentation: Salesforce B2C Commerce 19.10 > Merchandising Your Site > Content Assets > Content Assets for Developers > Content Best Practices. Here is the link to the section.

In the section the only topic covered is the XSS attacks prevention. I can not understand how the XSS attacks are related to the content assets.

The whole content assets data is created and managed in BM (i.e. on backend), so no client side script can change the data. So, I would consider the topic to be inappropriate to appear as a content assets related documentation section.

Also, the example there which uses the pdict.ProductSearchResult.searchPhrase is not related to the content assets in any way.

I would expect the section to appear somewhere in the ISML related documentation parts. May it be that the documentation developers made a mistake or am I missing something here?

  • It basically comes down to never trust any input that a human can control. All it would take is a disgruntled employee, a weak password for one of your Business Manager users, or a vulnerability on the Salesforce side of the equation, and your content assets are no longer trustworthy. Security is a game of defense in depth. – Derek F Oct 14 '19 at 13:02
  • @DerekF, hello. Thank you for the comment. But I believe that you are missing something. That is because the doc section suggests to set the content type and to use the isprint. But in case of an anuthorized access to the content assets in the BM by attackers how could I enforce the attackers to use the suggestions and how the use of the suggestions by the attackers would help to prevent the problems? Also, I believe that the malicious modification of the content assets in BM can not be considered an XSS attack. – iloveseven Oct 14 '19 at 14:25
  • Part of why I didn't make this an answer is because I'm not at all familiar with CommerceCloud or Business Manager. The point I think that the documentation is making is that without setting content type and/or using <isprint>, you open yourself up to XSS. Again, the name of the game is defense in depth. A modified asset can absolutely enable XSS (either directly, or through something like a maliciously crafted gif/jpg/png image). – Derek F Oct 14 '19 at 14:47
  • @DerekF, probably you are right. But still it does not make sense for me that the section was put into the content assets related documentation. Thank you. – iloveseven Oct 14 '19 at 18:25

Frankly, I think that document you referenced was placed in the wrong location. It has nothing to do with Content Assets except that a developer outputting a content asset content must ensure they properly encode that content for the rendering context. I've emailed the documentation maintainer about this potential issue.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.