Salesforce Security Review Error - Possible XSS / escape='false' : How to solve this issue for the below set of line

<div style='font-size:12px;'>"+calEvent.name+ " " +calEvent.lname+ "</div>");      

1 Answer 1


This code has a cross site scripting vulnerability: if calEvent.name, calEvent.status, or calEvent.lname contain html code, then this code will be rendered.

This is because you are using the unsafe .html() function which must never be used with external data unless that data is properly output encoded.

One option is to html-encode the parameters:

$calEvent.find(".wc-time").html(htmlEncode(calEvent.status) + "<br/>
<div style='font-size:12px;'>" + htmlEncode(calEvent.name) + " "
+ htmlEncode(calEvent.lname)+ "</div>");

Here htmlEncode should be a trusted (and not homespun) html encoding function -- we recommend the secureFilters library:


...in which case htmlEncode = secureFilters.html

Another option is to not use jQuery here at all, but build up the element directly with DOM accessors.

//assuming calEvent is your root DOM element
var elem = calEvent.getElementByClassName('wc-time')[0];
var child = document.createElement('div');
elem.textContent = calEvent.status;
child.style = 'font-size:12px;';
child.textContent = calEvent.name + " " + calEvent.lname;
elem.appendChild(child); //<br> is redundant here

Another approach if you have structured elements like this is to use an html template, with proper escaping (e.g. <%- -%>) in erb style templates.

There are other options as well. The point is that great care must be taken when using rendering functions such as .html() or .append().

  • $calEvent.find(".wc-time").html(htmlEncode(calEvent.status)+"<br/><div style='font-size:12px;'>"+htmlEncode(calEvent.name)+ " " +htmlEncode(calEvent.lname)+ "</div>"); Nov 16, 2015 at 8:49
  • Unable to execute the script due to the error = ReferenceError: HTMLENCODE is not defined Nov 16, 2015 at 9:00
  • You need a client side security library -- htmlEncode was just a placeholder. One good library to use is secure-filters. Salesforce currently does not ship a client side encoding library so you have to add a third party one. Nov 19, 2015 at 3:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .