Here is my requirement. in my visual force page i'm getting stored xss error in escape="false".
<apex:outputText value="{!wrk.html_description__c}" escape="false"> </apex:outputText>
-
Is html_description__c a text field, or rich text field?– sfdcfoxAug 20, 2014 at 6:30
Add a comment
|
1 Answer
If you are using tag with attribute “escape = false” then please make sure either The value being printed is some fixed non user inputted text like
<apex:outputText escape="false" value="{!"<!DOCTYPE html>"}"/>
Else, value is being escaped via Apex etc using Security Coding Library escape functions or any other equivalent. For ex.
String usertext = ApexPages.currentPage().getParameters().get('usertext');
// the next line encodes the usertext similar to the VisualForce HTMLENCODE function but within an Apex class.
usertext = ESAPI.encoder().SFDC_HTMLENCODE(usertext);
