I created a visualforce page, and i get some data(HTML) from webservice and store it in Custom Object as LongText, When i retrieve it and display in my visual force page something like this

<apex:outputText value = "{!myobjdata}" escape=false/>

It works fine, But when i give my application for the review, Then the Security Scanner gives error with above line and SELECT query of my object in class file (XSS_STORED)

Then I read about this XSS, and I added my data to visualforce page as below

<apex:outputText value = "{!HTMLENCODE(myobjdata)}" escape=false/>

But, now the data(HTML) in my object shows as it is like


in my visualforce page The HTML content is not rendered, How can i Overcome these issues (Mainly XSS)

Please help

  • rak, I've edited your post so your code will display. In the future, please select any code you've pasted in, then click on the braces icon {} for pre-formatted text so it won't be ignored or start it on a new line and space each line over by at least 4 spaces.
    – crmprogdev
    Mar 10, 2015 at 13:16

2 Answers 2


If you want to render HTML from an Apex Controller into a component unescaped you need to make sure that there is no active content, otherwise you will have a stored cross site scripting vulnerability. Currently the only (sane) way to do this is to pull the HTML from a rich text field. This will sanitize the html and make it safe for rendering via an escape='false' attribute.

The scanner will still complain because the scanner doesn't know about data types. That's fine, it's a false positive, and you will always get false positives. It wont cause trouble for you in the security review -- just make a note that this is coming from a Rich Text Field and so is safe to render unescaped.

So the real issue is whether the html is safe to render or not. If it's safe, then ignore the scanner, if it's not safe, you need to make it safe by storing it in a rich text field and then pulling it back out.

If it's not safe, and you try to trick the scanner by first encoding and then unencoding before rendering, then you will succeed in both tricking the scanner and inserting a vulnerability into your application, violating the Master Services Agreement that you signed, and compromising the security of anyone using this code.

The scanner is a tool meant to help you by pointing out possible issues in your code, but what matters is the actual security of your code.

  • I will try this...
    – anjnkmr
    Jun 16, 2015 at 3:23

A solution I have used before is to load the HTML content into a JavaScript variable and then use JQuery (or standard JavaScript) to insert the 'text' into the DOM structure in the correct place.

I think I did something like:-

var htmlInject = '{!HTMLENCODE(myobjdata)}';
//replace any escaped chars as necessary...
  • after doing this my Javascript code is not working properly, in the salesforce page layout section...
    – anjnkmr
    Jun 16, 2015 at 3:22
  • Do you get any useful information from the browser debugger? Perhaps there is a line break in the source and so that would need escaping before being added to the page html. Jun 16, 2015 at 8:47
  • No I don't see any error/ debug message in console, What i done here is i used some javascript to navigate between tabs, But after i used this only first tab displays information, and when i click next tabs it is navigating but doesn't show its content, All the content of tabs are loaded from a web-service call on load time and it loads correctly When i remove this technic and load normally without escaping
    – anjnkmr
    Jun 17, 2015 at 5:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .