0

I am trying to include survey force application with our existing app and creating a manage package. After submitting the code for Force.com Security review I have received below error messages:

Frame Spoofing

If a user supplied value is used to construct a frame within the page, it can lead to an attacker controlling what is rendered into the page. By modifying the URL value to a malicious site, an attacker can successfully launch a phishing scam to attempt to steal user credentials. Given the base domain is from an application they trust, they are more likely to believe the request as legitimate and provide the details requested.

Demonstrative Examples:

In the example below, the developer is taking input from the user from the querystring and using that to load into an iframe on the page:

With input provided from an attacker, the iframe will be rendered into the page with the host of the attackers choosing, such as the link below.

Potential Mitigations

Frame spoofing can be mitigated by strongly validating the user input provided to your application. In the case where

user input is needed to construct the parameters used in a frame, the developer should control the domain loaded

through a constant or white list if possible. The example below shows a very simplistic method

=================================================================================================================== Issue in Classes

  1. get //viewsharesurveycomponentcontroller.cls
    ...
  2. String urlPrefix = setupUrlPrefix(surveySite);

  3. private String setupUrlPrefix(String site) //viewsharesurveycomponentcontroller.cls
    ...

  4. return site+'/';

  5. get //viewsharesurveycomponentcontroller.cls

  6. String urlPrefix = setupUrlPrefix(surveySite); ...

  7. String urlToSave= domain+'/'+urlPrefix+'TakeSurvey?'; ...

  8. return urlToSave;
  9. //viewsharesurveycomponent.component

  10. public viewShareSurveyComponentController() //viewsharesurveycomponentcontroller.cls
    ...

  11. urlType.add(new SelectOption('Email Link w/ Contact Merge',System.Label.LABS_SF_Email_Link_w_Contact_Merge));
  12. //viewsharesurveycomponent.component
  13. get //viewsharesurveycomponentcontroller.cls
    ...
  14. String urlPrefix = setupUrlPrefix(surveySite);
  15. private String setupUrlPrefix(String site) //viewsharesurveycomponentcontroller.cls
  16. return site+'/'; ...
  17. get //viewsharesurveycomponentcontroller.cls ...
  18. String urlPrefix = setupUrlPrefix(surveySite);
    ...
  19. String urlToSave= domain+'/'+urlPrefix+'TakeSurvey?'; ...
  20. return urlToSave;

  21. //viewsharesurveycomponent.component

Any Idea ??

0

The scanner believes that your URL is being used as the location of a frame. Whether or not this is the case depends on the visualforce page/component code, which you don't provide.

Assuming that you are not building a frame, this is still a potential URL redirection attack depending on the inputs of your 'domain' variable, which isn't apparent from your sample code either.

To get more information, please send an email to sourcescanner@salesforce.com, or book an office hour: http://security.force.com/security/contact/ohours

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.