Questions tagged [xss]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
885 views

Lightning DOM XSS Injection Issue Reported in Checkmarx

After execution of checkmarx report we are facing injection issue for one of our aura lightning component  Issue reported :  The application's <aura:component implements="force:appHostable,...
user avatar
2 votes
0 answers
63 views

XSS when using merge field in JavaScript context - bad sanitization : escaping merge field for only HTML entities

I have a VisualForce page in which there's a <apex:outputText> with attribute escape="false". The good part is that merge field used for this tag is escaped for HTML entities using ...
user avatar
0 votes
0 answers
78 views

Unable to disable XSS-Protection

I am trying to disable XSS-Protection for our SF Org (Community portal) as its deprecated. I disabled it under Session settings 'Enable XSS-Protection'. However I still see it, set to 1 mode=block ...
user avatar
  • 187
4 votes
1 answer
198 views

Make Visualforce variable in Javascript pass Security Review

The following Javascript is embedded into a Visualforce page because it relies on Visualforce variables: <apex:page controller="myController" > <script> var foo1 =...
user avatar
6 votes
1 answer
215 views

Package review fails with new undocumented issues

My Managed package (yearly) Security Review failed with new issues I was not aware of and which I could not find documented anywhere, E.g.: Stored XSS - "Avoid using escape=false unless ...
user avatar
0 votes
0 answers
85 views

Injection Vulnerability Prevention

I am getting error in Understand Cross-Site Scripting (XSS) There was an unhandled exception. Please reference ID: OODKFWIY. Error: Restforce::ErrorCode::InvalidType. Message: INVALID_TYPE: select id ...
user avatar
2 votes
1 answer
1k views

Content Security Policy in Embedded Service's Post-chat VF page

Hi Salesforce community! I have set up an embedded service with a Post-chat page, which is overriden by a simple Visualforce page. The VF page code is very simple: <apex:page showHeader="false"&...
user avatar
  • 81
2 votes
1 answer
247 views

XSS in the content assets in SFCC

There is the following section in the SFCC documentation: Salesforce B2C Commerce 19.10 > Merchandising Your Site > Content Assets > Content Assets for Developers > Content Best Practices....
user avatar
  • 1,107
0 votes
1 answer
336 views

How to escape HTML or AMPscript in AMPscript variables?

I was wondering what happens when a customer is putting html or scripts in his profile attributes on Commerce Cloud and he orders something and we send out an order confirmation email with those ...
user avatar
6 votes
1 answer
1k views

Why use ESAPI for encoding?

We're working on getting out managed package to pass security review. In various documentation (including trailhead) Salesforce are recommending we use ESAPI for server side (apex) encoding. My ...
user avatar
  • 5,499
0 votes
1 answer
157 views

Making existing page XSS proof for Lightning Experience

Hi All I am migrating a visual force page to Lightning experience. All this page has is a javascript function which basically sets the height of the frame and calls another JS function. The frame ...
user avatar
1 vote
1 answer
68 views

How to xss attack here

I have a div with code like this, <div id="someId" data-role="someRole" data-ordered-list="[{name: 'Flow', text: '{!$Label.Flow_Data}'}]"> </div> I have a custom Label called Flow_data ...
user avatar
2 votes
0 answers
470 views

The CheckMarx security scanner gives error on Stored XSS vulnerability

I have a javaScript method in my visualforce page, which is adding a css when page loads. Code adds the css to radio buttons to look similar to Lightning radio buttons. var Row = document....
user avatar
1 vote
0 answers
229 views

XSS: Best way to encode href for anchor tags

What would be the best way to sanitize a user input for href on anchor tags? I've been looking at this library that is created and approved by Salesforce (SecureFilters) Looking at the different ...
user avatar
  • 646
5 votes
1 answer
6k views

How to test XSS/Content Sniffing protection in sandbox?

I have enabled XSS protection and Content Sniffing protection in sandbox. How can I test these security features in salesforce whether my org is XSS and content sniffing protected? I have enabled ...
user avatar
6 votes
1 answer
6k views

Why are there 3 functions to encode in Visualforce?

I'm following the Injection Vulnerability Prevention module on Salesforce Trailhead, and I'm reading about the Visualforce functions to encode data to prevent XSS attacks. To quote from the module: ...
user avatar
2 votes
1 answer
213 views

How to prevent DOM XSS Vulnerability for this script -

{!tableData} is Server variable. <script> $('.content').html("{!tableData}"); ... </script> "{!tableData}" is having HTML data.
user avatar
1 vote
1 answer
375 views

How do I fix Stored XSS error in salesforce?

The CheckMarx security scanner says that this line is a Stored XSS vulnerability. if(!{!acc.IsActive__c} && reqNDA == 'true' && document.getElementById(elem).checked){ in the ...
user avatar
0 votes
1 answer
488 views

Setting X-XSS-Protection response headers in Apex has no effect

I created a new Apex class: public with sharing class PWSHttpHeadersController { public PWSHttpHeadersController(){ ApexPages.currentPage().getHeaders().put('X-XSS-Protection','1; mode=block'); ...
user avatar
  • 101
2 votes
3 answers
5k views

What are some use cases for HTMLENCODE?

Can someone give me some use cases when I'd use HTMLENCODE? Or help explain the example in the documentation a little better?
user avatar
3 votes
1 answer
1k views

"Client Cross Frame Scripting Attack" by Checkmarx Scanner for Visualforce component

I have got the Client Cross Frame Scripting Attack alert in the recent CheckMarx scanner. However, it points to an auto generated ID. I've seen the following links however, the I'm not sure about ...
user avatar
3 votes
2 answers
7k views

How to JSENCODE from an apex controller?

I select a list of sObjects in my controller then pass directly to my visualforce page where I render out as a javascript object. I can't use JSENCODE in the visualforce page because I need the ...
user avatar
0 votes
1 answer
574 views

Client Cross Frame Scripting Attack by Checkmarx scanner for visualforce component, [duplicate]

I am Using visualforce component for insert and updating child record. this component is reusable for multiple objects, like account, contact, etc., as like we can use this. I am doing DML inside a ...
user avatar
0 votes
1 answer
554 views

Reflected XSS issue

I have found this issue when I have given my code to Code Scanner Reflected XSS This is basically because of two things Map<string,string> params = ApexPages.currentPage()....
user avatar
0 votes
1 answer
157 views

Getting Image Url From REST - Security Threat?

Just trying to figure out if the following plan exposes us to a security threat: We have defined a public REST Service that will accept POST requests. The above requests will create Image__c records ...
user avatar
  • 144k
4 votes
0 answers
585 views

How to Address DOM-based XSS from Security Review

I have a remoting function on my page that takes a list of contacts, and displays them in on Lightning Design styled page. It works fine, but the final innerHTML statement gets flagged in security ...
user avatar
3 votes
1 answer
10k views

How do I fix Stored XSS and Reflected XSS?

When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and ...
user avatar
7 votes
1 answer
5k views

How to avoid security risks with escape="False" in output tags

Ok, say for example the output we need on the page must include HTML tags and we want to avoid any security risks..... Scenerio 1: No user input, string is completely generated by apex code and ...
user avatar
  • 53.2k
3 votes
2 answers
1k views

How do I fix this Stored XSS?

The CheckMarx security scanner says that this line is a Stored XSS vulnerability <apex:column style="background-color:#{!trade.bgcolor};color:{!trade.fgcolor};"> is this HTMLENCODE the correct ...
user avatar
  • 713
1 vote
2 answers
5k views

How do I fix this Reflected XSS vulnerability?

The CheckMarx security scanner says that this line is a Reflected XSS vulnerability. <apex:outputText value="0,number,#,##0.00}" style="color:!nost.balColor};"> However this page http://www....
user avatar
  • 713
1 vote
2 answers
3k views

How do I fix this Stored XSS vulnerability?

The CheckMarx security scanner says that the 4th line: $j('#h{!category}').on('click', function(event) { in the following script, causes an XSS vulnerability. Can someone explain the best way to ...
user avatar
  • 713