Questions tagged [stored-xss]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
1answer
373 views

How to resolve Stored XSS issue in salesforce security scan result?

Below is the example code for this issue <apex:OutputText value="{!question.selectedVal}" escape="false"/> We cannot remove the escape false because we need to show the HTML content. How to ...
2
votes
1answer
109 views

How to prevent DOM XSS Vulnerability for this script -

{!tableData} is Server variable. <script> $('.content').html("{!tableData}"); ... </script> "{!tableData}" is having HTML data.
1
vote
1answer
173 views

How do I fix Stored XSS error in salesforce?

The CheckMarx security scanner says that this line is a Stored XSS vulnerability. if(!{!acc.IsActive__c} && reqNDA == 'true' && document.getElementById(elem).checked){ in the ...
0
votes
1answer
397 views

Stored XSS in database.query

We have submitted our code to security review. i'm facing stored xss vulnarabities as described in below lines, please some one help me on this. public map<string,RecordType> RecordTypeMap(...
0
votes
1answer
260 views

The CheckMarx security scanner says that these lines is a Stored XSS

Do not know why checkmarx throwing these errors. As there is nothing that needs to be HTMLENCODE. Although VF page showing the data that is being added from Line 344 and 345 from a <apex:...
2
votes
2answers
226 views

SOQL Query: Stored XSS Error

I have given my code for Security code Scanner but it is given the following error due to Query: Stored XSS My query is like this. loan=Database.query('SELECT Name, fintechLLC__Application__c, '+ ...
0
votes
1answer
123 views

Getting Image Url From REST - Security Threat?

Just trying to figure out if the following plan exposes us to a security threat: We have defined a public REST Service that will accept POST requests. The above requests will create Image__c records ...
2
votes
2answers
4k views

How to display custom HTML in my Visualforce Page

I created a visualforce page, and i get some data(HTML) from webservice and store it in Custom Object as LongText, When i retrieve it and display in my visual force page something like this <apex:...
2
votes
1answer
6k views

How do I fix Stored XSS and Reflected XSS?

When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and ...
0
votes
1answer
525 views

How to fix the Stored xss error in salesforce

Here is my requirement. in my visual force page i'm getting stored xss error in escape="false". <apex:outputText value="{!wrk.html_description__c}" escape="false"> </apex:outputText>
6
votes
1answer
2k views

How to avoid security risks with escape=“False” in output tags

Ok, say for example the output we need on the page must include HTML tags and we want to avoid any security risks..... Scenerio 1: No user input, string is completely generated by apex code and ...
8
votes
2answers
972 views

Checkmarx and JSON.serialize

My Salesforce1 code has been recently run through Force.com Security Scanner (a.k.a. Checkmarx). A stored XSS vulnerability has been found and marked as critical security risk. It boils down to ...
3
votes
2answers
1k views

How do I fix this Stored XSS?

The CheckMarx security scanner says that this line is a Stored XSS vulnerability <apex:column style="background-color:#{!trade.bgcolor};color:{!trade.fgcolor};"> is this HTMLENCODE the correct ...
1
vote
2answers
3k views

How do I fix this Reflected XSS vulnerability?

The CheckMarx security scanner says that this line is a Reflected XSS vulnerability. <apex:outputText value="0,number,#,##0.00}" style="color:!nost.balColor};"> However this page http://www....
1
vote
2answers
1k views

How do I fix this Stored XSS vulnerability?

The CheckMarx security scanner says that the 4th line: $j('#h{!category}').on('click', function(event) { in the following script, causes an XSS vulnerability. Can someone explain the best way to ...