I have a checkmarx issue in below VF page code as A3-Cross-Site Scripting (XSS) onclick

<apex:facet name="header">
             <input type="checkbox" value="{!C.isSelected}" id="pg:formId:pgBlock:pbTable2:isAllSelected" name="Action" onclick="checkAll(this,{!clogs.size})"/>Action

I am calling a JS function in the VF page

 function checkAll (cb,Clogsize)
       var i;
        var tableId = 'pg:formId:pgBlock:pbTable:';
        for (i=0;i<Clogsize;i++)
            document.getElementById(tableId +i+':isSelected').checked = true;
        for (i=0;i<Clogsize;i++)
            document.getElementById(tableId +i+':isSelected').checked = false; 

1 Answer 1


Your script part has nothing to do with the XSS. Most likely, it's {!C.isSelected}, but without seeing the other bits of code, it's hard to tell for sure. The safest option here is to just add JSINHTMLENCODE: {!JSINHTMLENCODE(C.isSelected}) and {!JSINHTMLENCODE(clogs.size)}.

  • thanks @sfdcfox it worked
    – user75937
    Jun 23, 2021 at 10:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .