Reflected XSS problem

Question

Checkmarx is flagging these lines as Reflected XSS,Lately I have been doing a lot of research on this but couldn't solve this one can someone point me as to why these are major security threats?

public atest(){

pageParams = ApexPages.currentPage().getParameters();

arId=EncodingUtil.urlDecode(pageParams.get(Aid),ENCODING_SCHEME);

Answer 1

For XSS (Cross Site Scripting )Issue About: Cross-site scripting is a vulnerability that occurs when an attacker can insert unauthorized JavaScript, VBScript, HTML, or other active content into a web page viewed by other users.

This issue raised when controllervariable are being used in JavaScript / JQuery .

Example:

Public class mycontroller{

String myval{get;set;}

Public mycontroller(){

Myval=’Hello Page Loaded’;

}

}

//On page

<Script>

Varscriptvar = ‘{!myval}’;

Alert(scriptvar);

</script>

POSSIBLE SOLUTION:

Varscriptvar = ‘{!JSENCODE(myvar)}’;