Cross-Site Scripting in visual force input

Ask Question

Asked 4 years, 9 months ago

Modified 4 years, 9 months ago

Viewed 690 times

We have received a security warning regarding Cross-Site Scripting for below input :

<apex:inputtext value="{!mergeText}" id="txtField" disabled="true" size="25"/>

What changes are required to bypass this warning? I have tried JSENCODE but these functions are used with javascript/apex:outputText

asked Dec 5, 2019 at 11:52

Rohit

2,1712 gold badges13 silver badges21 bronze badges

do you display this mergeText on the page, or is it passed to the back-end?
– Oleksandr Berehovskyi
Commented Dec 5, 2019 at 12:04
It is displayed on the page and also passed to apex class.
– Rohit
Commented Dec 5, 2019 at 12:07
Rohit, is this comment from Checkmarx? If so, can you email rsussland at salesforce dot com the the scan Id of your report? Thanks.
– Robert Sussland
Commented Dec 5, 2019 at 23:27
@RobertSussland , This comment is from fortify scan.
– Rohit
Commented Dec 6, 2019 at 3:23
Then you should reach out to your Fortify support and notify them of this false positive.
– Robert Sussland
Commented Dec 6, 2019 at 6:42

Add a comment |

0