0

After execution of checkmarx report we are facing injection issue for one of our aura lightning component 

Issue reported : 

The application's <aura:component implements="force:appHostable,flexipage:availableForAllPageTypes,lightning:isUrlAddressable" access="global" > embeds untrusted data in the generated output with url, at line 1. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.

Issue reported at line number 3 of below code

Code: 

<aura:component implements="force:appHostable,flexipage:availableForAllPageTypes,lightning:isUrlAddressable" access="global" >
    <aura:attribute name="testDummyurl" type="String" />
    <iframe scrolling="no" style="position:absolute;top:0px;width:100%;height:100vh;" src="{!v.testDummyurl}" />
</aura:component>

Please help me and let me know how we can overcome this injection issue reported by checkmarx

Improve this question
1

1 Answer 1

Reset to default
2

The iframe src attribute can be used to execute malicious javascript code (see here). For example, testDummyurl could equal the code below, which would cause an alert message to appear when the user loads the page:

javascript:alert('hello')

To resolve this issue, you can explicitly set the iframe's src protocol to http / https:

<iframe scrolling="no" style="position:absolute;top:0px;width:100%;height:100vh;" src="https://{!v.testDummyurl}" />
Improve this answer
1
  • Sure Tyler. I will give it a try and will update how it is behaving after the change.
    – SalesforceEnthuDev10
    Mar 7, 2022 at 6:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .