Questions tagged [stored-xss]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
2k views

How vulnerable is Salesforce to XSS attacks?

I'm working through tightening up our security and I'm curious about the vulnerabilities that are legitimate in Salesforce. I know that there are plenty of vague descriptions about "XSS Scripting&...
thinker's user avatar
  • 1,432
0 votes
1 answer
360 views

How to fix SOQL Query Stored XSS

I have given my code for Security code Scanner but it is given the following error due to String attachmentQuery = 'SELECT id,E2CAdv__Attachment__c, E2CAdv__CaseId__c, E2CAdv__Attachment_links__c, ...
Sonu Sagar's user avatar
2 votes
1 answer
909 views

How to resolve Stored XSS issue in salesforce security scan result?

Below is the example code for this issue <apex:OutputText value="{!question.selectedVal}" escape="false"/> We cannot remove the escape false because we need to show the HTML content. How to ...
Gopalakrishna Boddepalli's user avatar
2 votes
1 answer
374 views

How to prevent DOM XSS Vulnerability for this script -

{!tableData} is Server variable. <script> $('.content').html("{!tableData}"); ... </script> "{!tableData}" is having HTML data.
Kavita Beniwal's user avatar
1 vote
1 answer
460 views

How do I fix Stored XSS error in salesforce?

The CheckMarx security scanner says that this line is a Stored XSS vulnerability. if(!{!acc.IsActive__c} && reqNDA == 'true' && document.getElementById(elem).checked){ in the ...
Murali Mohan Mandadi's user avatar
0 votes
1 answer
1k views

Stored XSS in database.query

We have submitted our code to security review. i'm facing stored xss vulnarabities as described in below lines, please some one help me on this. public map<string,RecordType> RecordTypeMap(...
SFDC_Igle's user avatar
  • 692
0 votes
1 answer
2k views

The CheckMarx security scanner says that these lines is a Stored XSS

Do not know why checkmarx throwing these errors. As there is nothing that needs to be HTMLENCODE. Although VF page showing the data that is being added from Line 344 and 345 from a <apex:...
AKSHAY Dhiman's user avatar
2 votes
2 answers
456 views

SOQL Query: Stored XSS Error

I have given my code for Security code Scanner but it is given the following error due to Query: Stored XSS My query is like this. loan=Database.query('SELECT Name, fintechLLC__Application__c, '+ ...
Shantanu Mahajan's user avatar
0 votes
1 answer
189 views

Getting Image Url From REST - Security Threat?

Just trying to figure out if the following plan exposes us to a security threat: We have defined a public REST Service that will accept POST requests. The above requests will create Image__c records ...
Adrian Larson's user avatar
  • 150k
4 votes
2 answers
6k views

How to display custom HTML in my Visualforce Page

I created a visualforce page, and i get some data(HTML) from webservice and store it in Custom Object as LongText, When i retrieve it and display in my visual force page something like this <apex:...
anjnkmr's user avatar
  • 253
3 votes
1 answer
11k views

How do I fix Stored XSS and Reflected XSS?

When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and ...
Sapthagiri's user avatar
0 votes
1 answer
807 views

How to fix the Stored xss error in salesforce

Here is my requirement. in my visual force page i'm getting stored xss error in escape="false". <apex:outputText value="{!wrk.html_description__c}" escape="false"> </apex:outputText>
fsales572's user avatar
  • 321
7 votes
1 answer
6k views

How to avoid security risks with escape="False" in output tags

Ok, say for example the output we need on the page must include HTML tags and we want to avoid any security risks..... Scenerio 1: No user input, string is completely generated by apex code and ...
Eric's user avatar
  • 54.2k
8 votes
2 answers
3k views

Checkmarx and JSON.serialize

My Salesforce1 code has been recently run through Force.com Security Scanner (a.k.a. Checkmarx). A stored XSS vulnerability has been found and marked as critical security risk. It boils down to ...
eyescream's user avatar
  • 24.1k
3 votes
2 answers
2k views

How do I fix this Stored XSS?

The CheckMarx security scanner says that this line is a Stored XSS vulnerability <apex:column style="background-color:#{!trade.bgcolor};color:{!trade.fgcolor};"> is this HTMLENCODE the correct ...
Andrew's user avatar
  • 735
1 vote
2 answers
8k views

How do I fix this Reflected XSS vulnerability?

The CheckMarx security scanner says that this line is a Reflected XSS vulnerability. <apex:outputText value="0,number,#,##0.00}" style="color:!nost.balColor};"> However this page http://www....
Andrew's user avatar
  • 735
2 votes
2 answers
4k views

How do I fix this Stored XSS vulnerability?

The CheckMarx security scanner says that the 4th line: $j('#h{!category}').on('click', function(event) { in the following script, causes an XSS vulnerability. Can someone explain the best way to ...
Andrew's user avatar
  • 735