Questions tagged [xss]
The xss tag has no usage guidance.
28
questions
4
votes
1answer
110 views
Make Visualforce variable in Javascript pass Security Review
The following Javascript is embedded into a Visualforce page because it relies on Visualforce variables:
<apex:page controller="myController" >
<script>
var foo1 =...
6
votes
1answer
169 views
Package review fails with new undocumented issues
My Managed package (yearly) Security Review failed with new issues I was not aware of and which I could not find documented anywhere, E.g.:
Stored XSS - "Avoid using escape=false unless ...
0
votes
0answers
78 views
Injection Vulnerability Prevention
I am getting error in Understand Cross-Site Scripting (XSS)
There was an unhandled exception. Please reference ID: OODKFWIY.
Error: Restforce::ErrorCode::InvalidType. Message: INVALID_TYPE:
select id ...
2
votes
0answers
448 views
Content Security Policy in Embedded Service's Post-chat VF page
Hi Salesforce community!
I have set up an embedded service with a Post-chat page, which is overriden by a simple Visualforce page.
The VF page code is very simple:
<apex:page showHeader="false"&...
2
votes
1answer
147 views
XSS in the content assets in SFCC
There is the following section in the SFCC documentation:
Salesforce B2C Commerce 19.10 > Merchandising Your Site > Content Assets > Content Assets for Developers > Content Best Practices....
0
votes
1answer
178 views
How to escape HTML or AMPscript in AMPscript variables?
I was wondering what happens when a customer is putting html or scripts in his profile attributes on Commerce Cloud and he orders something and we send out an order confirmation email with those ...
6
votes
1answer
769 views
Why use ESAPI for encoding?
We're working on getting out managed package to pass security review. In various documentation (including trailhead) Salesforce are recommending we use ESAPI for server side (apex) encoding.
My ...
0
votes
1answer
128 views
Making existing page XSS proof for Lightning Experience
Hi All I am migrating a visual force page to Lightning experience. All this page has is a javascript function which basically sets the height of the frame and calls another JS function. The frame ...
1
vote
1answer
59 views
How to xss attack here
I have a div with code like this,
<div id="someId" data-role="someRole"
data-ordered-list="[{name: 'Flow', text: '{!$Label.Flow_Data}'}]">
</div>
I have a custom Label called Flow_data ...
2
votes
0answers
275 views
The CheckMarx security scanner gives error on Stored XSS vulnerability
I have a javaScript method in my visualforce page, which is adding a css when page loads.
Code adds the css to radio buttons to look similar to Lightning radio buttons.
var Row = document....
1
vote
0answers
206 views
XSS: Best way to encode href for anchor tags
What would be the best way to sanitize a user input for href on anchor tags? I've been looking at this library that is created and approved by Salesforce (SecureFilters)
Looking at the different ...
4
votes
1answer
5k views
How to test XSS/Content Sniffing protection in sandbox?
I have enabled XSS protection and Content Sniffing protection in sandbox.
How can I test these security features in salesforce whether my org is XSS and content sniffing protected?
I have enabled ...
6
votes
1answer
5k views
Why are there 3 functions to encode in Visualforce?
I'm following the Injection Vulnerability Prevention module on Salesforce Trailhead, and I'm reading about the Visualforce functions to encode data to prevent XSS attacks.
To quote from the module:
...
2
votes
1answer
156 views
How to prevent DOM XSS Vulnerability for this script -
{!tableData} is Server variable.
<script>
$('.content').html("{!tableData}"); ...
</script>
"{!tableData}" is having HTML data.
1
vote
1answer
276 views
How do I fix Stored XSS error in salesforce?
The CheckMarx security scanner says that this line is a Stored XSS vulnerability.
if(!{!acc.IsActive__c} && reqNDA == 'true' && document.getElementById(elem).checked){
in the ...
0
votes
1answer
406 views
Setting X-XSS-Protection response headers in Apex has no effect
I created a new Apex class:
public with sharing class PWSHttpHeadersController {
public PWSHttpHeadersController(){
ApexPages.currentPage().getHeaders().put('X-XSS-Protection','1; mode=block');
...
2
votes
3answers
4k views
What are some use cases for HTMLENCODE?
Can someone give me some use cases when I'd use HTMLENCODE? Or help explain the example in the documentation a little better?
3
votes
1answer
1k views
“Client Cross Frame Scripting Attack” by Checkmarx Scanner for Visualforce component
I have got the Client Cross Frame Scripting Attack alert in the recent CheckMarx scanner. However, it points to an auto generated ID.
I've seen the following links however, the I'm not sure about ...
3
votes
2answers
6k views
How to JSENCODE from an apex controller?
I select a list of sObjects in my controller then pass directly to my visualforce page where I render out as a javascript object. I can't use JSENCODE in the visualforce page because I need the ...
0
votes
1answer
555 views
Client Cross Frame Scripting Attack by Checkmarx scanner for visualforce component, [duplicate]
I am Using visualforce component for insert and updating child record. this component is reusable for multiple objects, like account, contact, etc., as like we can use this. I am doing DML inside a ...
0
votes
1answer
427 views
Reflected XSS issue
I have found this issue when I have given my code to Code Scanner
Reflected XSS
This is basically because of two things
Map<string,string> params =
ApexPages.currentPage()....
0
votes
1answer
133 views
Getting Image Url From REST - Security Threat?
Just trying to figure out if the following plan exposes us to a security threat:
We have defined a public REST Service that will accept POST requests.
The above requests will create Image__c records ...
4
votes
0answers
476 views
How to Address DOM-based XSS from Security Review
I have a remoting function on my page that takes a list of contacts, and displays them in on Lightning Design styled page. It works fine, but the final innerHTML statement gets flagged in security ...
3
votes
1answer
9k views
How do I fix Stored XSS and Reflected XSS?
When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and ...
7
votes
1answer
4k views
How to avoid security risks with escape=“False” in output tags
Ok, say for example the output we need on the page must include HTML tags and we want to avoid any security risks.....
Scenerio 1: No user input, string is completely generated by apex code and ...
3
votes
2answers
1k views
How do I fix this Stored XSS?
The CheckMarx security scanner says that this line is a Stored XSS vulnerability
<apex:column style="background-color:#{!trade.bgcolor};color:{!trade.fgcolor};">
is this HTMLENCODE the correct ...
1
vote
2answers
4k views
How do I fix this Reflected XSS vulnerability?
The CheckMarx security scanner says that this line is a Reflected XSS vulnerability.
<apex:outputText value="0,number,#,##0.00}" style="color:!nost.balColor};">
However this page
http://www....
1
vote
2answers
2k views
How do I fix this Stored XSS vulnerability?
The CheckMarx security scanner says that the 4th line:
$j('#h{!category}').on('click', function(event) {
in the following script, causes an XSS vulnerability. Can someone explain the best way to ...
