Questions tagged [xss]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
35 views

Reflected XSS vulnerability in checkmarx

The CheckMarx security scanner says that the below line is a Reflected XSS vulnerability. zip = apexpages.currentpage().getparameters().get('gnfzipcode').escapeHtml4(); The above code is from an Apex ...
Aditya Negi's user avatar
-1 votes
1 answer
29 views

Sanitize input in Aura component

Checkermax report has identified Client DOM XSS issue for the input parameter whose value is in the format of !caselst.casenumber Here caselst is the variable for the list of cases. List of cases are ...
Pratikshya Satapathy's user avatar
0 votes
0 answers
41 views

How to preserve rich text formatting in contentNote after escaping HTML characters to prevent XSS attack

I need to insert contentNote record from apex rest api. Below is the sample code ContentNote noteRecord = new ContentNote(); noteRecord.Title = 'Title'; String body = restJSONdata.get(...
Monalisa Das's user avatar
0 votes
1 answer
1k views

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE ID 80)(1 flaw) [duplicate]

In my page even I have applied JSENCODE in few places to fix the flaw. But no luck. Still it is showing the flaw. Can anyone please help where it is exactly causing flaw. <apex:page ...
Vineeth Singh's user avatar
0 votes
1 answer
329 views

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

I have generated a Varacode report for my visualforce Page showing flaws in that page.Below is my page and class please suggest how to fix ? In Page at line number 5 showing the Flaw where Script tag ...
Nitish's user avatar
  • 1
0 votes
1 answer
3k views

Lightning DOM XSS Injection Issue Reported in Checkmarx

After execution of checkmarx report we are facing injection issue for one of our aura lightning component  Issue reported :  The application's <aura:component implements="force:appHostable,...
SalesforceEnthuDev10's user avatar
2 votes
0 answers
173 views

XSS when using merge field in JavaScript context - bad sanitization : escaping merge field for only HTML entities

I have a VisualForce page in which there's a <apex:outputText> with attribute escape="false". The good part is that merge field used for this tag is escaped for HTML entities using ...
bhargava_k08's user avatar
4 votes
1 answer
296 views

Make Visualforce variable in Javascript pass Security Review

The following Javascript is embedded into a Visualforce page because it relies on Visualforce variables: <apex:page controller="myController" > <script> var foo1 =...
Robert Sösemann's user avatar
7 votes
1 answer
248 views

Package review fails with new undocumented issues

My Managed package (yearly) Security Review failed with new issues I was not aware of and which I could not find documented anywhere, E.g.: Stored XSS - "Avoid using escape=false unless ...
Robert Sösemann's user avatar
0 votes
0 answers
98 views

Injection Vulnerability Prevention

I am getting error in Understand Cross-Site Scripting (XSS) There was an unhandled exception. Please reference ID: OODKFWIY. Error: Restforce::ErrorCode::InvalidType. Message: INVALID_TYPE: select id ...
Vruti Tankaria's user avatar
3 votes
1 answer
3k views

Content Security Policy in Embedded Service's Post-chat VF page

Hi Salesforce community! I have set up an embedded service with a Post-chat page, which is overriden by a simple Visualforce page. The VF page code is very simple: <apex:page showHeader="false"&...
drozdps's user avatar
  • 91
2 votes
1 answer
374 views

XSS in the content assets in SFCC

There is the following section in the SFCC documentation: Salesforce B2C Commerce 19.10 > Merchandising Your Site > Content Assets > Content Assets for Developers > Content Best Practices....
iloveseven's user avatar
  • 1,115
0 votes
1 answer
611 views

How to escape HTML or AMPscript in AMPscript variables?

I was wondering what happens when a customer is putting html or scripts in his profile attributes on Commerce Cloud and he orders something and we send out an order confirmation email with those ...
user3485470's user avatar
6 votes
1 answer
1k views

Why use ESAPI for encoding?

We're working on getting out managed package to pass security review. In various documentation (including trailhead) Salesforce are recommending we use ESAPI for server side (apex) encoding. My ...
Nick C's user avatar
  • 6,585
0 votes
1 answer
191 views

Making existing page XSS proof for Lightning Experience

Hi All I am migrating a visual force page to Lightning experience. All this page has is a javascript function which basically sets the height of the frame and calls another JS function. The frame ...
Quest_sfdc's user avatar
1 vote
1 answer
132 views

How to xss attack here

I have a div with code like this, <div id="someId" data-role="someRole" data-ordered-list="[{name: 'Flow', text: '{!$Label.Flow_Data}'}]"> </div> I have a custom Label called Flow_data ...
user avatar
2 votes
0 answers
657 views

The CheckMarx security scanner gives error on Stored XSS vulnerability

I have a javaScript method in my visualforce page, which is adding a css when page loads. Code adds the css to radio buttons to look similar to Lightning radio buttons. var Row = document....
Sunil Raj's user avatar
1 vote
0 answers
327 views

XSS: Best way to encode href for anchor tags

What would be the best way to sanitize a user input for href on anchor tags? I've been looking at this library that is created and approved by Salesforce (SecureFilters) Looking at the different ...
kev_panda's user avatar
  • 656
5 votes
1 answer
10k views

How to test XSS/Content Sniffing protection in sandbox?

I have enabled XSS protection and Content Sniffing protection in sandbox. How can I test these security features in salesforce whether my org is XSS and content sniffing protected? I have enabled ...
Jack vardy's user avatar
7 votes
1 answer
7k views

Why are there 3 functions to encode in Visualforce?

I'm following the Injection Vulnerability Prevention module on Salesforce Trailhead, and I'm reading about the Visualforce functions to encode data to prevent XSS attacks. To quote from the module: ...
user avatar
2 votes
1 answer
374 views

How to prevent DOM XSS Vulnerability for this script -

{!tableData} is Server variable. <script> $('.content').html("{!tableData}"); ... </script> "{!tableData}" is having HTML data.
Kavita Beniwal's user avatar
1 vote
1 answer
460 views

How do I fix Stored XSS error in salesforce?

The CheckMarx security scanner says that this line is a Stored XSS vulnerability. if(!{!acc.IsActive__c} && reqNDA == 'true' && document.getElementById(elem).checked){ in the ...
Murali Mohan Mandadi's user avatar
0 votes
1 answer
646 views

Setting X-XSS-Protection response headers in Apex has no effect

I created a new Apex class: public with sharing class PWSHttpHeadersController { public PWSHttpHeadersController(){ ApexPages.currentPage().getHeaders().put('X-XSS-Protection','1; mode=block'); ...
RyanP13's user avatar
  • 101
2 votes
3 answers
6k views

What are some use cases for HTMLENCODE?

Can someone give me some use cases when I'd use HTMLENCODE? Or help explain the example in the documentation a little better?
PartOfTheOhana's user avatar
3 votes
1 answer
1k views

"Client Cross Frame Scripting Attack" by Checkmarx Scanner for Visualforce component

I have got the Client Cross Frame Scripting Attack alert in the recent CheckMarx scanner. However, it points to an auto generated ID. I've seen the following links however, the I'm not sure about ...
Vignesh Damodharan's user avatar
3 votes
2 answers
9k views

How to JSENCODE from an apex controller?

I select a list of sObjects in my controller then pass directly to my visualforce page where I render out as a javascript object. I can't use JSENCODE in the visualforce page because I need the ...
user1813867's user avatar
0 votes
1 answer
578 views

Client Cross Frame Scripting Attack by Checkmarx scanner for visualforce component, [duplicate]

I am Using visualforce component for insert and updating child record. this component is reusable for multiple objects, like account, contact, etc., as like we can use this. I am doing DML inside a ...
Dupada Ds's user avatar
0 votes
1 answer
643 views

Reflected XSS issue

I have found this issue when I have given my code to Code Scanner Reflected XSS This is basically because of two things Map<string,string> params = ApexPages.currentPage()....
Shantanu Mahajan's user avatar
0 votes
1 answer
189 views

Getting Image Url From REST - Security Threat?

Just trying to figure out if the following plan exposes us to a security threat: We have defined a public REST Service that will accept POST requests. The above requests will create Image__c records ...
Adrian Larson's user avatar
  • 150k
4 votes
0 answers
825 views

How to Address DOM-based XSS from Security Review

I have a remoting function on my page that takes a list of contacts, and displays them in on Lightning Design styled page. It works fine, but the final innerHTML statement gets flagged in security ...
BritishBoyinDC's user avatar
3 votes
1 answer
11k views

How do I fix Stored XSS and Reflected XSS?

When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and ...
Sapthagiri's user avatar
7 votes
1 answer
6k views

How to avoid security risks with escape="False" in output tags

Ok, say for example the output we need on the page must include HTML tags and we want to avoid any security risks..... Scenerio 1: No user input, string is completely generated by apex code and ...
Eric's user avatar
  • 54.2k
3 votes
2 answers
2k views

How do I fix this Stored XSS?

The CheckMarx security scanner says that this line is a Stored XSS vulnerability <apex:column style="background-color:#{!trade.bgcolor};color:{!trade.fgcolor};"> is this HTMLENCODE the correct ...
Andrew's user avatar
  • 735
1 vote
2 answers
8k views

How do I fix this Reflected XSS vulnerability?

The CheckMarx security scanner says that this line is a Reflected XSS vulnerability. <apex:outputText value="0,number,#,##0.00}" style="color:!nost.balColor};"> However this page http://www....
Andrew's user avatar
  • 735
2 votes
2 answers
4k views

How do I fix this Stored XSS vulnerability?

The CheckMarx security scanner says that the 4th line: $j('#h{!category}').on('click', function(event) { in the following script, causes an XSS vulnerability. Can someone explain the best way to ...
Andrew's user avatar
  • 735