0

ISSUE: XSS issue in the following code, value fields will not expect JSENCODE as it expects a Boolean.

I have tried following options

OPTIONS: value= Boolean('{!JSENCODE(IF(ques.Question__c,"true", "false"))}')

Error: Open quote is expected for attribute "value" associated with an element type "apex:selectRadio".

value= "Boolean('{!JSENCODE(IF(ques.Question__c,"true", "false"))}')"

Error: The element type "apex:selectRadio" must be terminated by the matching end-tag "</apex:selectRadio>". (the closing tag already exist)

value= "{!IF(ques.Question__c, true, false)}"

Error: Incorrect parameter type for function 'IF()'. Expected Boolean, received Text

value= "{!IF(ques.Question__c, 'true', 'false')}"

Error: Incorrect parameter type for function 'IF()'. Expected Boolean, received Text

CODE:

<apex:selectRadio styleClass="{!ques.QNum__c}" value= {!ques.Question__c}
                                                    
onclick="javascript:showHideQuestion(JSENCODE(this,{!cs.isp__c},{!cs.isfi__c}); 
 showMsgPopup(this,'{!JSENCODE(ques.Question__c)}'));"
                                                      
rendered="{!NOT(OR(ques.IsNA__c,ques.Question__c = 'application?'))}">                                   
    <apex:selectOption itemValue="Yes" itemLabel="Yes"/>
    <apex:selectOption itemValue="No" itemLabel="No"/>
</apex:selectRadio>

1 Answer 1

0

Error: Open quote is expected for attribute "value" associated with an element type "apex:selectRadio".

You're missing quotes for value.

Error: The element type "apex:selectRadio" must be terminated by the matching end-tag "</apex:selectRadio>". (the closing tag already exist)

It doesn't like one of the attributes you wrote, and so it couldn't find the end-tag, even though it's in your source code.

Error: Incorrect parameter type for function 'IF()'. Expected Boolean, received Text

The first parameter of IF needs to resolve to a TRUE/FALSE value (note: not "TRUE" or "FALSE", in quotes, as those are strings). Your Question__c field is text, so you get this error.

JSENCODE isn't appropriate for <apex:*> elements that do not directly translate to attributes. It should only be used in literal HTML, as in:

<script>
let value = "{!JSENCODE(someVar)}";
</script>

And for attributes, you need JSINHTMLENCODE:

<a href="javascript:{!JSINHTMLENCODE(someVar)}">A link</a>

Also, as a general rule:

IF(condition, true, false)

Is the same as:

condition

You should only use IF for text, numbers, dates, etc.

IF(age>=18, 'You can legally vote!','Sorry, you cannot vote yet.')

javascript: is only meant to be used with href attributes to call JavaScript. Do not use it for onclick, etc.

Further, JSENCODE needs to be in a merge field. Merge fields start with {! and terminate with }.

Your onclick should read more like:

onclick="showHideQuestion(
  this,
  '{!JSINHTMLENCODE(cs.isp__c)}',
  '{!JSINHTMLENCODE(cs.isfi__c)}'
);
showMsgPopup(
  this,
  '{!JSINHTMLENCODE(ques.Question__c)}'
);"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .