0

I'm working through tightening up our security and I'm curious about the vulnerabilities that are legitimate in Salesforce. I know that there are plenty of vague descriptions about "XSS Scripting" in the Salesforce ecosystem. However, Salesforce Developers rarely go into the specifics, and for good reason, however, their code-scanner plugin that runs PMD still detects XSS vulnerabilities and it is difficult to know what kind of XSS scripting that we are dealing with, stored or reflective.

TL;DR

Are Salesforce LWC, AURA, and Visualforce pages vulnerable to stored XSS attacks, or are they only reflective XSS attacks? Article describing XSS attacks. It seems to me that stored XSS attacks would be impossible, since you have to pass unit tests for production code changes to be deployed.

Improve this question

1 Answer 1

Reset to default
1

In Visualforce, both reflective and stored XSS is possible. This involves not using JSENCODE, HTMLENCODE, JSINHTMLENCODE, any standard element, or using escape="false" on elements that support the attribute.

In Aura and LWC, reflective and stored XSS is "kind of" possible, but scripts cannot run in the DOM if inserted, which means visual artifacts only (but note that a form could be injected, allowing a user to manually submit data to a malicious site).

In formula fields and a few other places where you can put in free-form configuration, you could also merge in unescaped HTML, although the UI generally automatically sanitizes those values upon retrieval, so XSS is generally not possible.

Visualforce Examples

 //// Scripts
 // Reflective
 var someVar = {!$CurrentPage.parameters.someParam};
 // Stored
 var someVar = {!someRecord.SomeField};
 // Solution
 {!JSENCODE($CurrentPage.parameters.someParam)};

 <!-- Markup -->
 <!-- Reflective -->
 {!$CurrentPage.parameters.someParam}
 <apex:outputText escape="false" value="{!$CurrentPage.parameters.someParam}" />

 <!-- Stored -->
 {!someRecord.SomeField}
 <apex:outputText escape="false" value="{!someRecord.SomeField}" />

 <!-- Solutions -->
 <apex:outputText value="{!$CurrentPage.parameters.someParam}" />
 {!HTMLENCODE($CurrentPage.parameters.someParam)}

Aura Example

<aura:unescapedHtml>
  {!v.someAttribute}
</aura:unescapedHtml>

LWC Example

this.template.querySelector('some-element').innerHTML = someValue;

Note that the latter two examples are still sanitized by Locker Service, so it's still mostly harmless to do this, but you should consider appropriate mitigation strategies if you intend to do this.

Also note that aside from these very rare circumstances, using attributes/properties in Aura and LWC are generally safe, as you cannot disable the protections that merge fields/expressions offer.

Improve this answer
8
  • one thing I'm confused. Reflective seems to require a phishing scam. But the stored XSS persists. I'm confused about how the XSS persistence occurs. On the examples I have attempted to learn from via Youtube, on refresh don't persist. Are you saying, that doing a 'innerHtml' attack just makes the file update?
    – thinker
    Jul 1, 2021 at 15:47
  • 1
    @thinker A stored XSS is when you store malicious code in a database and then subsequently get it to execute through vulnerable code. innerHtml only affects the page until it reloads, it is not persistent. It's how the malicious code gets there that determines if it's reflective or stored XSS.
    – sfdcfox
    Jul 1, 2021 at 16:00
  • thanks for the clarity. I guess it seems like the stored option would be extremely difficult on Salesforce given the various profile and permission sets that would be required to get around. I'm just confused on how the XSS gets committed to the database. but I think it just came to me...
    – thinker
    Jul 1, 2021 at 16:03
  • 1
    @thinker Not in a LWC. Scripts are very specifically forbidden outside of a few standard mechanisms, and also enforced by browser CSP (Content Security Policy). That's part of what makes LWC so secure. However, a developer could do something like an innerHtml trick to render text, and then a field could have some HTML in it and show a form or something. That's about the extent of it.
    – sfdcfox
    Jul 1, 2021 at 16:39
  • 1
    @thinker XSS is essentially only possible in the older technologies (Visualforce, S-Controls). Lightning doesn't have this problem at all.
    – sfdcfox
    Jul 1, 2021 at 22:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .