Before I submit my app for Security Review I checked it with the free scanner. It marked the following line of JS-code in a Visualforce as Critical XSS vulnerability:

<script>var trueOrFalse = '{!MyObject__c.chk_CheckboxField__c}';</script>

As far as I know I cannot go into security review with such findings, although this is a False Positive as the report mentions. How can I cure this efficiently?

<script>var trueOrFalse = '{!JSENCODE(MyObject__c.chk_CheckboxField__c)}';</script>

does not work as JSENCODE expects text and not boolean.

<script>var trueOrFalse = '{!JSENCODE(TEXT(MyObject__c.chk_CheckboxField__c))}';</script>

also doesn't work, as TEXT() not accepts Boolean values.

What should I do?

  • 2
    You can include a document describing your false positives, and explaining why you did it this way. – pjcarly Apr 18 '14 at 13:42
  • @RobertSösemann Have you figured out the best approach to deal with the same? I am facing the same challenge. – Madhavi Bhattad Dec 20 '18 at 6:32

You do not need to rewrite the code to eliminate scanner false positives -- there will always be false positives.

However, if you want to rewrite the code, then you can replace a boolean with a text literal and then cast to a Bool.

var foo = Boolean('{!JSENCODE(IF(MyObject__c.chk_CheckboxField__c,"true", "false"))}'); //absurd way to quiet scanner

As an aside, in the next iteration of the rules, this false positive should be taken care of.

| improve this answer | |
  • 2
    Did anyone come up with a better - less hacky - solution since 2014? It obscures my code in so many places that I still didn't use it. – Robert Sösemann Aug 24 '17 at 15:26
  • Boolean('false') and Boolean('true') both will return true because both are booleans. – Fabiano Shark Jul 9 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.