Questions tagged [xss]
The xss tag has no usage guidance.
31
questions
0
votes
1
answer
885
views
Lightning DOM XSS Injection Issue Reported in Checkmarx
After execution of checkmarx report we are facing injection issue for one of our aura lightning component
Issue reported :
The application's <aura:component
implements="force:appHostable,...
2
votes
0
answers
63
views
XSS when using merge field in JavaScript context - bad sanitization : escaping merge field for only HTML entities
I have a VisualForce page in which there's a <apex:outputText> with attribute escape="false".
The good part is that merge field used for this tag is escaped for HTML entities using ...
- 81
0
votes
0
answers
78
views
Unable to disable XSS-Protection
I am trying to disable XSS-Protection for our SF Org (Community portal) as its deprecated. I disabled it under Session settings 'Enable XSS-Protection'. However I still see it, set to 1 mode=block ...
- 187
4
votes
1
answer
198
views
Make Visualforce variable in Javascript pass Security Review
The following Javascript is embedded into a Visualforce page because it relies on Visualforce variables:
<apex:page controller="myController" >
<script>
var foo1 =...
- 34.9k
6
votes
1
answer
215
views
Package review fails with new undocumented issues
My Managed package (yearly) Security Review failed with new issues I was not aware of and which I could not find documented anywhere, E.g.:
Stored XSS - "Avoid using escape=false unless ...
- 34.9k
0
votes
0
answers
85
views
Injection Vulnerability Prevention
I am getting error in Understand Cross-Site Scripting (XSS)
There was an unhandled exception. Please reference ID: OODKFWIY.
Error: Restforce::ErrorCode::InvalidType. Message: INVALID_TYPE:
select id ...
2
votes
1
answer
1k
views
Content Security Policy in Embedded Service's Post-chat VF page
Hi Salesforce community!
I have set up an embedded service with a Post-chat page, which is overriden by a simple Visualforce page.
The VF page code is very simple:
<apex:page showHeader="false"&...
- 81
2
votes
1
answer
247
views
XSS in the content assets in SFCC
There is the following section in the SFCC documentation:
Salesforce B2C Commerce 19.10 > Merchandising Your Site > Content Assets > Content Assets for Developers > Content Best Practices....
- 1,107
0
votes
1
answer
336
views
How to escape HTML or AMPscript in AMPscript variables?
I was wondering what happens when a customer is putting html or scripts in his profile attributes on Commerce Cloud and he orders something and we send out an order confirmation email with those ...
- 115
6
votes
1
answer
1k
views
Why use ESAPI for encoding?
We're working on getting out managed package to pass security review. In various documentation (including trailhead) Salesforce are recommending we use ESAPI for server side (apex) encoding.
My ...
- 5,499
0
votes
1
answer
157
views
Making existing page XSS proof for Lightning Experience
Hi All I am migrating a visual force page to Lightning experience. All this page has is a javascript function which basically sets the height of the frame and calls another JS function. The frame ...
- 359
1
vote
1
answer
68
views
How to xss attack here
I have a div with code like this,
<div id="someId" data-role="someRole"
data-ordered-list="[{name: 'Flow', text: '{!$Label.Flow_Data}'}]">
</div>
I have a custom Label called Flow_data ...
user51525
2
votes
0
answers
470
views
The CheckMarx security scanner gives error on Stored XSS vulnerability
I have a javaScript method in my visualforce page, which is adding a css when page loads.
Code adds the css to radio buttons to look similar to Lightning radio buttons.
var Row = document....
- 21
1
vote
0
answers
229
views
XSS: Best way to encode href for anchor tags
What would be the best way to sanitize a user input for href on anchor tags? I've been looking at this library that is created and approved by Salesforce (SecureFilters)
Looking at the different ...
- 646
5
votes
1
answer
6k
views
How to test XSS/Content Sniffing protection in sandbox?
I have enabled XSS protection and Content Sniffing protection in sandbox.
How can I test these security features in salesforce whether my org is XSS and content sniffing protected?
I have enabled ...
- 878
6
votes
1
answer
6k
views
Why are there 3 functions to encode in Visualforce?
I'm following the Injection Vulnerability Prevention module on Salesforce Trailhead, and I'm reading about the Visualforce functions to encode data to prevent XSS attacks.
To quote from the module:
...
user24634
2
votes
1
answer
213
views
How to prevent DOM XSS Vulnerability for this script -
{!tableData} is Server variable.
<script>
$('.content').html("{!tableData}"); ...
</script>
"{!tableData}" is having HTML data.
1
vote
1
answer
375
views
How do I fix Stored XSS error in salesforce?
The CheckMarx security scanner says that this line is a Stored XSS vulnerability.
if(!{!acc.IsActive__c} && reqNDA == 'true' && document.getElementById(elem).checked){
in the ...
0
votes
1
answer
488
views
Setting X-XSS-Protection response headers in Apex has no effect
I created a new Apex class:
public with sharing class PWSHttpHeadersController {
public PWSHttpHeadersController(){
ApexPages.currentPage().getHeaders().put('X-XSS-Protection','1; mode=block');
...
- 101
2
votes
3
answers
5k
views
What are some use cases for HTMLENCODE?
Can someone give me some use cases when I'd use HTMLENCODE? Or help explain the example in the documentation a little better?
- 10.2k
3
votes
1
answer
1k
views
"Client Cross Frame Scripting Attack" by Checkmarx Scanner for Visualforce component
I have got the Client Cross Frame Scripting Attack alert in the recent CheckMarx scanner. However, it points to an auto generated ID.
I've seen the following links however, the I'm not sure about ...
- 1,574
3
votes
2
answers
7k
views
How to JSENCODE from an apex controller?
I select a list of sObjects in my controller then pass directly to my visualforce page where I render out as a javascript object. I can't use JSENCODE in the visualforce page because I need the ...
- 673
0
votes
1
answer
574
views
Client Cross Frame Scripting Attack by Checkmarx scanner for visualforce component, [duplicate]
I am Using visualforce component for insert and updating child record. this component is reusable for multiple objects, like account, contact, etc., as like we can use this. I am doing DML inside a ...
0
votes
1
answer
554
views
Reflected XSS issue
I have found this issue when I have given my code to Code Scanner
Reflected XSS
This is basically because of two things
Map<string,string> params =
ApexPages.currentPage()....
- 984
0
votes
1
answer
157
views
Getting Image Url From REST - Security Threat?
Just trying to figure out if the following plan exposes us to a security threat:
We have defined a public REST Service that will accept POST requests.
The above requests will create Image__c records ...
- 144k
4
votes
0
answers
585
views
How to Address DOM-based XSS from Security Review
I have a remoting function on my page that takes a list of contacts, and displays them in on Lightning Design styled page. It works fine, but the final innerHTML statement gets flagged in security ...
- 13k
3
votes
1
answer
10k
views
How do I fix Stored XSS and Reflected XSS?
When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and ...
- 931
7
votes
1
answer
5k
views
How to avoid security risks with escape="False" in output tags
Ok, say for example the output we need on the page must include HTML tags and we want to avoid any security risks.....
Scenerio 1: No user input, string is completely generated by apex code and ...
- 53.2k
3
votes
2
answers
1k
views
How do I fix this Stored XSS?
The CheckMarx security scanner says that this line is a Stored XSS vulnerability
<apex:column style="background-color:#{!trade.bgcolor};color:{!trade.fgcolor};">
is this HTMLENCODE the correct ...
- 713
1
vote
2
answers
5k
views
How do I fix this Reflected XSS vulnerability?
The CheckMarx security scanner says that this line is a Reflected XSS vulnerability.
<apex:outputText value="0,number,#,##0.00}" style="color:!nost.balColor};">
However this page
http://www....
- 713
1
vote
2
answers
3k
views
How do I fix this Stored XSS vulnerability?
The CheckMarx security scanner says that the 4th line:
$j('#h{!category}').on('click', function(event) {
in the following script, causes an XSS vulnerability. Can someone explain the best way to ...
- 713