Checkmarx scanner says A3-Cross-Site Scripting (XSS)

Question

I have a checkmarx issue in below VF page code as A3-Cross-Site Scripting (XSS) onclick

<apex:facet name="header">
             <input type="checkbox" value="{!C.isSelected}" id="pg:formId:pgBlock:pbTable2:isAllSelected" name="Action" onclick="checkAll(this,{!clogs.size})"/>Action
         </apex:facet>

I am calling a JS function in the VF page

 function checkAll (cb,Clogsize)
    {
       var i;
        var tableId = 'pg:formId:pgBlock:pbTable:';
        if(cb.checked)
        for (i=0;i<Clogsize;i++)
            document.getElementById(tableId +i+':isSelected').checked = true;
        if(!cb.checked)
        for (i=0;i<Clogsize;i++)
            document.getElementById(tableId +i+':isSelected').checked = false; 
    }

Answer 1

Your script part has nothing to do with the XSS. Most likely, it's {!C.isSelected}, but without seeing the other bits of code, it's hard to tell for sure. The safest option here is to just add JSINHTMLENCODE: {!JSINHTMLENCODE(C.isSelected}) and {!JSINHTMLENCODE(clogs.size)}.