I'm getting results back from the source scanner for XSRF issues where the result path spans an apex:commandButton
.
A number of the XSRF paths in my report follow a pattern:
- In the controllers constructor a query string request parameter is read and stored in a member (non-volatile, so it will go via the view state).
- An apex:commandButton calls a controller Apex method
- The apex method subsequently performs a DML operation, such as updating an Opportunity. The member from step 1 may influence the DML operation.
Example XSRF involving POST request:
XSRF result path 47: Path Id: -1811245813
Object: get in file: unpackaged\classes\XyzController.cls
L 2059: addNewRecord = Integer.valueOf(System.currentPageReference().getParameters().get('addNewRecord'));
Object: valueof in file: unpackaged\classes\XyzController.cls
L 2059: addNewRecord = Integer.valueOf(System.currentPageReference().getParameters().get('addNewRecord'));
Object: addNewRecord in file: unpackaged\classes\XyzController.cls
L 2059: addNewRecord = Integer.valueOf(System.currentPageReference().getParameters().get('addNewRecord'));
Object: loadSaveRecord63 in file: unpackaged\pages\SaveRecord.page
L 166: <apex:commandButton value="Save Selected Records" action="{!saveMultipleOli}" rendered="{! multipleRecordsSelected && !enableMultiLineRecordEditing}"/>
Object: savemultipleoli62 in file: unpackaged\pages\SaveRecord.page
L 166: <apex:commandButton value="Save Selected Records" action="{!saveMultipleOli}" rendered="{! multipleRecordsSelected && !enableMultiLineRecordEditing}"/>
Object: savemultipleoli in file: unpackaged\classes\XyzController.cls
L 3271: PageReference pr = saveMultipleOli(RecordMapper);
Object: opp in file: unpackaged\classes\XyzController.cls
L 3659: update opp;
Object: update in file: unpackaged\classes\XyzController.cls
L 3659: update opp;
My understanding was that Salesforce provides XSRF protection for POST requests, such as those that originate from a apex:commandButton.
Is the problem that the query string parameter is ultimately returned to the method via view state and could be used in updating the record?
I’m confident enough to flag these as false positives, especially due to the ultimate usage of the query string parameter. It seems to me this would be an extremely common outcome after reading a query string parameter and that the ViewStateCSRF form value in the post back should be sufficient.