How do we sanitize variables/controller calls [v.onRepeat/c.controllerCall] used in onclick/onchange events as per SonarQube standards.

Here is the sample code : Issue 1 : <lightning:buttonIcon tooltip="test" alternativeText="test" type="test" iconName="test" onclick="{!v.onrepeat}"> </lightning:buttonIcon>

Issue 2 :
<.. onclick="{!c.controllerCall}"> .. </>

Can JSENCODE or HTMLENCODE be used? how do we use them on variables/controllers here.

1 Answer 1


You don't sanitize variables or controller calls. The Aura framework does this automatically for you. By the way, the onclick may not work as you expect, as you're trying to call an attribute (v.), not a controller function (c.).

  • yes I did read an article stating the same about aura framework handling, but upon running SONARQUBE on my code, these are some of the issues that were highlighted. Also, as per this article "developer.salesforce.com/docs/…" this is an unsafe combination => any[tag] on* (event handler)[attribute] js execution context[Issue]
    – Dusk123
    Aug 23, 2022 at 12:42
  • @Dee Can you point out some specific messages? It's hard to imagine how any code scanner would identify errors in this code.
    – sfdcfox
    Aug 23, 2022 at 12:43
  • Yes this is the message -"Avoid unescaped/sanitized content in output"
    – Dusk123
    Aug 23, 2022 at 12:44
  • @Dee It must be pointing to something else, or the scanner is broken. There's nothing in the code you posted that would trigger this in something like Checkmarx. Doublecheck and make sure it's not actually pointing to something else?
    – sfdcfox
    Aug 23, 2022 at 12:46
  • I'm doubly sure @sfdcfox. I have around 300 odd issues and most of them are pointing to that onchange/onclick event.. some point out variables some the controller call. Can we use JSENCODE/HTMLENCODE or do you have any other suggestion for these issues ?
    – Dusk123
    Aug 23, 2022 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .