0

Is <apex:output tag is XSS free if I put sensitive data will it get executed ? Do I i need to implement some prevention mechanism for XSS fix for <apex:otputField? If it is XSS free how is the implementation or how salesforce handles this? Thanks in advance.

Improve this question

1 Answer 1

Reset to default
2

All the standard apex: tags in Visualforce have XSS protection provided although XSS vulnerable characters can have escaping turned off using the escape="false" attribute.

The security documentation found here is very detailed and should give you all the information you need.

Improve this answer
1
  • I would add that this is actually one of the primary reasons to use apex:output instead of binding {!var} directly - although I believe even the latter includes some XSS protection now. The components, though, are a VF friendly way of letting the system off protection.
    – joshbirk
    Commented Feb 21, 2014 at 19:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .