Questions tagged [stored-xss]
The stored-xss tag has no usage guidance.
20 questions
8
votes
2
answers
3k
views
Checkmarx and JSON.serialize
My Salesforce1 code has been recently run through Force.com Security Scanner (a.k.a. Checkmarx). A stored XSS vulnerability has been found and marked as critical security risk.
It boils down to ...
- 24.2k
7
votes
1
answer
7k
views
How to avoid security risks with escape="False" in output tags
Ok, say for example the output we need on the page must include HTML tags and we want to avoid any security risks.....
Scenerio 1: No user input, string is completely generated by apex code and ...
- 54.4k
4
votes
2
answers
7k
views
How to display custom HTML in my Visualforce Page
I created a visualforce page, and i get some data(HTML) from webservice and store it in Custom Object as LongText, When i retrieve it and display in my visual force page something like this
<apex:...
- 253
3
votes
1
answer
11k
views
How do I fix Stored XSS and Reflected XSS?
When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and ...
- 931
3
votes
2
answers
2k
views
How do I fix this Stored XSS?
The CheckMarx security scanner says that this line is a Stored XSS vulnerability
<apex:column style="background-color:#{!trade.bgcolor};color:{!trade.fgcolor};">
is this HTMLENCODE the correct ...
- 745
2
votes
2
answers
4k
views
How do I fix this Stored XSS vulnerability?
The CheckMarx security scanner says that the 4th line:
$j('#h{!category}').on('click', function(event) {
in the following script, causes an XSS vulnerability. Can someone explain the best way to ...
- 745
2
votes
1
answer
941
views
How to resolve Stored XSS issue in salesforce security scan result?
Below is the example code for this issue
<apex:OutputText value="{!question.selectedVal}" escape="false"/>
We cannot remove the escape false because we need to show the HTML content.
How to ...
2
votes
2
answers
471
views
SOQL Query: Stored XSS Error
I have given my code for Security code Scanner but it is given the following error due to
Query: Stored XSS
My query is like this.
loan=Database.query('SELECT Name, fintechLLC__Application__c, '+
...
- 984
2
votes
1
answer
406
views
How to prevent DOM XSS Vulnerability for this script -
{!tableData} is Server variable.
<script>
$('.content').html("{!tableData}"); ...
</script>
"{!tableData}" is having HTML data.
1
vote
2
answers
9k
views
How do I fix this Reflected XSS vulnerability?
The CheckMarx security scanner says that this line is a Reflected XSS vulnerability.
<apex:outputText value="0,number,#,##0.00}" style="color:!nost.balColor};">
However this page
http://www....
- 745
1
vote
0
answers
61
views
How to resolve Stored/Reflected XSS for arguments passed to JS functions in a VF page?
Overview:
I am looking for ways to bypass Stored/Reflected XSS issues that are showing up as part of CheckMarx Scan report for the arguments passed to js functions in a VF Page, given that queries in ...
1
vote
1
answer
80
views
XSS attack on a Boolean variable
Checkmarx is detecting XSS vulnerability on my code which contains a boolean variable is_Private_Label__c.
Is there any way to fix this issue as we can't add the JSENCODE here as the data type is ...
- 23
1
vote
1
answer
488
views
How do I fix Stored XSS error in salesforce?
The CheckMarx security scanner says that this line is a Stored XSS vulnerability.
if(!{!acc.IsActive__c} && reqNDA == 'true' && document.getElementById(elem).checked){
in the ...
0
votes
1
answer
3k
views
The CheckMarx security scanner says that these lines is a Stored XSS
Do not know why checkmarx throwing these errors. As there is nothing that needs to be HTMLENCODE. Although VF page showing the data that is being added from Line 344 and 345 from a <apex:...
- 397
0
votes
1
answer
2k
views
How vulnerable is Salesforce to XSS attacks?
I'm working through tightening up our security and I'm curious about the vulnerabilities that are legitimate in Salesforce. I know that there are plenty of vague descriptions about "XSS Scripting&...
- 1,482
0
votes
1
answer
197
views
Getting Image Url From REST - Security Threat?
Just trying to figure out if the following plan exposes us to a security threat:
We have defined a public REST Service that will accept POST requests.
The above requests will create Image__c records ...
- 151k
0
votes
1
answer
838
views
How to fix the Stored xss error in salesforce
Here is my requirement. in my visual force page i'm getting stored xss error in escape="false".
<apex:outputText value="{!wrk.html_description__c}" escape="false"> </apex:outputText>
- 321
0
votes
0
answers
24
views
How to resolve JSON serialized object for Stored XSS in checkmarx scanner
We are trying to use JSON serialized Sobject in our VF page. Checkmarx is throwing out an Stored XSS error.
We are querying a Sobject and using that JSON.Serailized object in our js in Vf page.
Class:
...
- 12.4k
0
votes
1
answer
449
views
How to fix SOQL Query Stored XSS
I have given my code for Security code Scanner but it is given the following error due to
String attachmentQuery = 'SELECT id,E2CAdv__Attachment__c, E2CAdv__CaseId__c, E2CAdv__Attachment_links__c, ...
0
votes
1
answer
1k
views
Stored XSS in database.query
We have submitted our code to security review. i'm facing stored xss vulnarabities as described in below lines, please some one help me on this.
public map<string,RecordType> RecordTypeMap(...
- 692