Ok, say for example the output we need on the page must include HTML tags and we want to avoid any security risks.....

Scenerio 1: No user input, string is completely generated by apex code and displayed by the page. - Is there any risk, if so what is the best way to avoid

Scenerio 2: String is constructed in a way that user input is added to the string. The input has string.escapeSingleQuotes() AND .escapeHTML4() applied. - The obvious risks are Injection and XSS but those would appear to be negated by the applied methods. What if any additional risks are present?

Keep in mind that the application needs the output of the string to contain the HTML elements the apex code adds so it will not be an option to set escape="true"

This question is both a learning question and a best practice question as this is one of the most frequent reasons apps fail security review.


For the first scenario, there's no risk, because the code being emitted is directly created by the developer and is under the developer's full control. There's no risk of malicious injection, so there's no security risk.

For the second scenario, you should escape the content that's not under your control. For example, you might do this:

output += String.format('<td>{0}</td>', new String[] { userInput.escapeHtml4(); });

The intent is to make a cell (td) with whatever user content they desire. By escaping the input so that greater-than, less-than, ampersand, quote, and apostrophe are replaced with HTML entities, you guarantee that no script injection can occur, malforming the page or even executing arbitrary JavaScript.

escapeSingleQuotes is for SOQL, and should not be used for escaping HTML. It won't cause any security problem, but it would cause extra apostrophes to appear in the output. Other than that, there's no other risks that you'd run into, since escaping the four main character entities that would be used for XSS will eliminate any known security risk.

  • A user posted on another thread 'a java script written on browser can be used to hack this' when I mentioned that escapeHTML4() would not be an issue: salesforce.stackexchange.com/questions/46797/… - - - Do you see any way this could be the case. After all that is what prompted the thread here was because I do not know of any way to inject javascript into a rendered page and somehow getting a response from the server that could be an issue
    – Eric
    Aug 14 '14 at 3:20
  • The important part is to understand that user injectable text should only be allowed within tags. Do not allow untrusted strings anywhere else. This is the most common use case anyways, but that means you shall not use untrusted text to replace tags, attributes, comments, scripts, etc. See owasp.org/index.php/… for more details. As long as you strictly use the escape function for the intended purpose, you'll be completely safe.
    – sfdcfox
    Aug 14 '14 at 14:34
  • I created a visualforce page, and i get some data(HTML) from webservice and store it in Custom Object as LongText, When i retrive it and display in my visual force page something like this It works fine, But when i give my application for the review, Then the Security Scanner gives error with above line and SELECT query of my object in class file (XSS_STORED) Please help salesforce.stackexchange.com/questions/68786/…
    – anjnkmr
    Mar 10 '15 at 13:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.