Checkmarx is flagging these lines as Reflected XSS,Lately I have been doing a lot of research on this but couldn't solve this one can someone point me as to why these are major security threats?

public atest(){

pageParams = ApexPages.currentPage().getParameters();

  • It is not the problem with class. IT is problem on Visualforce page.
    – Ashwani
    Jun 17 '15 at 11:25
  • This is what I also think, there's problem with the VF page which has been flagged but I just can't figure out why do they flag lines in the class.
    – user13277
    Jun 17 '15 at 11:26

For XSS (Cross Site Scripting )Issue About: Cross-site scripting is a vulnerability that occurs when an attacker can insert unauthorized JavaScript, VBScript, HTML, or other active content into a web page viewed by other users.

This issue raised when controllervariable are being used in JavaScript / JQuery .


Public class mycontroller{

String myval{get;set;}

Public mycontroller(){

Myval=’Hello Page Loaded’;



//On page


Varscriptvar = ‘{!myval}’;




Varscriptvar = ‘{!JSENCODE(myvar)}’;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy