2

When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and CSS" or due to other reasons. Is there are a way to fix these, if so, please help me as I would want to submit the application for code review.

Best Regards

4

Lets first understand what is XSS and see what are the possible ways to prevent this

Cross-site scripting(XSS) is a vulnerability that occurs when an attacker can insert unauthorized JavaScript, VBScript, HTML, or other active content into a web page viewed by other users. A malicious script inserted into a page in this manner can hijack the user’s session, submit unauthorized transactions as the user, steal confidential information

Mechanism provided in VF to Overcome this issue

1)Built in Auto Encoding

All merge-fields are always auto HTML encoded provided they

i)do not occur within a or tag

ii)do not occur within an apex tag with the escape='false' attribute

2)Built in VisualForce encoding functions

The platform provides the following VisualForce encoding functions:

JSENCODE -- performs string encoding within a Javascript String context

HTMLENCODE -- encodes all characters with the appropriate HTML character references so as to avoid interpretation of characters as markup.

URLENCODE -- performs URI encoding (% style encoding) within a URL component context

JSINHTMLENCODE -- a convenience method that is equivalent to the composition of HTMLENCODE(JSENCODE(x))

There is a detailed article in below link

https://developer.salesforce.com/page/Secure_Coding_Cross_Site_Scripting

Sample example

<div onclick="this.innerHTML='Howdy {!Account.Name}'">Click me!</div>

The above is vulnerable

Lets see how we use Encode functions to rectify this

<!-- safe -->
 <div onclick="this.innerHTML='Howdy {!JSENCODE(HTMLENCODE(Account.Name))}'">Click me!</div>

The above is safe since we have use HTMLENCODE AND JSENCODE to encode and hence its hard for attacker to inject script or insert iframe

  • Thanks @mohit for the reply and briefing out on XSS. I could understand partially of what is mentioned in your comment and from the referral link provided. But, I am not certain on where exactly to make changes in the VF page to overcome this. Is it possible to provide any kind of examples for the ones mentioned in your reply. – Sapthagiri Jan 2 '15 at 14:57
  • Added explanation .Wherever you see merge field used without any apex tag or merge field inside javascript its vulnerable to attack and hence JSENCODE or HTMLENCODE – Mohith Shrivastava Jan 2 '15 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.