Skip to main content

Questions tagged [stored-xss]

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

How to resolve JSON serialized object for Stored XSS in checkmarx scanner

We are trying to use JSON serialized Sobject in our VF page. Checkmarx is throwing out an Stored XSS error. We are querying a Sobject and using that JSON.Serailized object in our js in Vf page. Class: ...
Prady's user avatar
  • 12.4k
1 vote
0 answers
61 views

How to resolve Stored/Reflected XSS for arguments passed to JS functions in a VF page?

Overview: I am looking for ways to bypass Stored/Reflected XSS issues that are showing up as part of CheckMarx Scan report for the arguments passed to js functions in a VF Page, given that queries in ...
Arnab Kanti Roy's user avatar
1 vote
1 answer
80 views

XSS attack on a Boolean variable

Checkmarx is detecting XSS vulnerability on my code which contains a boolean variable is_Private_Label__c. Is there any way to fix this issue as we can't add the JSENCODE here as the data type is ...
Aditya Negi's user avatar
0 votes
1 answer
2k views

How vulnerable is Salesforce to XSS attacks?

I'm working through tightening up our security and I'm curious about the vulnerabilities that are legitimate in Salesforce. I know that there are plenty of vague descriptions about "XSS Scripting&...
thinker's user avatar
  • 1,482
0 votes
1 answer
449 views

How to fix SOQL Query Stored XSS

I have given my code for Security code Scanner but it is given the following error due to String attachmentQuery = 'SELECT id,E2CAdv__Attachment__c, E2CAdv__CaseId__c, E2CAdv__Attachment_links__c, ...
Sonu Sagar's user avatar
2 votes
1 answer
941 views

How to resolve Stored XSS issue in salesforce security scan result?

Below is the example code for this issue <apex:OutputText value="{!question.selectedVal}" escape="false"/> We cannot remove the escape false because we need to show the HTML content. How to ...
Gopalakrishna Boddepalli's user avatar
2 votes
1 answer
406 views

How to prevent DOM XSS Vulnerability for this script -

{!tableData} is Server variable. <script> $('.content').html("{!tableData}"); ... </script> "{!tableData}" is having HTML data.
Kavita Beniwal's user avatar
1 vote
1 answer
488 views

How do I fix Stored XSS error in salesforce?

The CheckMarx security scanner says that this line is a Stored XSS vulnerability. if(!{!acc.IsActive__c} && reqNDA == 'true' && document.getElementById(elem).checked){ in the ...
Murali Mohan Mandadi's user avatar
0 votes
1 answer
1k views

Stored XSS in database.query

We have submitted our code to security review. i'm facing stored xss vulnarabities as described in below lines, please some one help me on this. public map<string,RecordType> RecordTypeMap(...
SFDC_Igle's user avatar
  • 692
0 votes
1 answer
3k views

The CheckMarx security scanner says that these lines is a Stored XSS

Do not know why checkmarx throwing these errors. As there is nothing that needs to be HTMLENCODE. Although VF page showing the data that is being added from Line 344 and 345 from a <apex:...
AKSHAY Dhiman's user avatar
2 votes
2 answers
471 views

SOQL Query: Stored XSS Error

I have given my code for Security code Scanner but it is given the following error due to Query: Stored XSS My query is like this. loan=Database.query('SELECT Name, fintechLLC__Application__c, '+ ...
Shantanu Mahajan's user avatar
0 votes
1 answer
197 views

Getting Image Url From REST - Security Threat?

Just trying to figure out if the following plan exposes us to a security threat: We have defined a public REST Service that will accept POST requests. The above requests will create Image__c records ...
Adrian Larson's user avatar
  • 151k
4 votes
2 answers
7k views

How to display custom HTML in my Visualforce Page

I created a visualforce page, and i get some data(HTML) from webservice and store it in Custom Object as LongText, When i retrieve it and display in my visual force page something like this <apex:...
anjnkmr's user avatar
  • 253
3 votes
1 answer
11k views

How do I fix Stored XSS and Reflected XSS?

When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and ...
Sapthagiri's user avatar
0 votes
1 answer
838 views

How to fix the Stored xss error in salesforce

Here is my requirement. in my visual force page i'm getting stored xss error in escape="false". <apex:outputText value="{!wrk.html_description__c}" escape="false"> </apex:outputText>
fsales572's user avatar
  • 321
7 votes
1 answer
7k views

How to avoid security risks with escape="False" in output tags

Ok, say for example the output we need on the page must include HTML tags and we want to avoid any security risks..... Scenerio 1: No user input, string is completely generated by apex code and ...
Eric's user avatar
  • 54.4k
8 votes
2 answers
3k views

Checkmarx and JSON.serialize

My Salesforce1 code has been recently run through Force.com Security Scanner (a.k.a. Checkmarx). A stored XSS vulnerability has been found and marked as critical security risk. It boils down to ...
eyescream's user avatar
  • 24.2k
3 votes
2 answers
2k views

How do I fix this Stored XSS?

The CheckMarx security scanner says that this line is a Stored XSS vulnerability <apex:column style="background-color:#{!trade.bgcolor};color:{!trade.fgcolor};"> is this HTMLENCODE the correct ...
Andrew's user avatar
  • 745
1 vote
2 answers
9k views

How do I fix this Reflected XSS vulnerability?

The CheckMarx security scanner says that this line is a Reflected XSS vulnerability. <apex:outputText value="0,number,#,##0.00}" style="color:!nost.balColor};"> However this page http://www....
Andrew's user avatar
  • 745
2 votes
2 answers
4k views

How do I fix this Stored XSS vulnerability?

The CheckMarx security scanner says that the 4th line: $j('#h{!category}').on('click', function(event) { in the following script, causes an XSS vulnerability. Can someone explain the best way to ...
Andrew's user avatar
  • 745