Initially I thought the answer to this question was yes, so malicious JavaScript cannot be injected into the page if it is in the response.
Yet upon a further look at this question it is a lot harder to inject JavaScript than you may think (or at least I did). I think the most common example is some malicious user enters script into a text field on a record, this value is queried, added to the page, and there you go...JavaScript injection. Except even if you do this, the JavaScript will not execute it as it appears to be completely ignored by the browser. Take the following example. JavaScript Remoting returns a script tag and this is added to the page but the alert() never happens.
public class Inject {
@RemoteAction
public static String getScriptString(){
//Pretend this could be queried from a record
return '<div>hi<script type="text/javascript">alert("Hello.");</script></div>';
}
}
<input type="button" value="Inject!" onclick="injectScript();"/>
<div id="target" style="border: 1px solid grey; height: 50px;"></div>
<script type="text/javascript">
function injectScript(){
//Do remoting call to get script and add it to and existing DIV on the page, and a new div, neither cause the alert
Visualforce.remoting.Manager.invokeAction('{!$RemoteAction.Inject.getScriptString}', function(result, event){
if (event.status) {
//Existing div
document.getElementById('target').innerHTML = result;
//New div, still no alert
var newDiv = document.createElement('div');
newDiv.innerHTML = result;
document.body.appendChild(newDiv);
}
},{escape: false});
}
</script>
So two questions really. Why is the alert() not happening and what is the danger of returning un-escaped results? Is this simply to escape HTML and is more of a display and formatting issue? An example would be great.
Thanks,
Jason