7

Lets first understand what is XSS and see what are the possible ways to prevent this Cross-site scripting(XSS) is a vulnerability that occurs when an attacker can insert unauthorized JavaScript, VBScript, HTML, or other active content into a web page viewed by other users. A malicious script inserted into a page in this manner can hijack the user’s ...


6

Your page's javascript is effectively using the eval style of deserializing JSON which has been frowned upon in general ever since browsers started having pretty widespread support for JSON.parse. If you don't need to support old versions of IE (and if you do there's polyfils) it's really, really a better idea to do something like var recent = JSON.parse('{...


5

I believe its because you are using an unescaped output in your JS $j('#h{!category}').css("background-color","{!entity.CPHeader__c}"); . Instead use the JSENCODE formula $j('#h{!category}').css("background-color","{!JSENCODE(entity.CPHeader__c)}"); for further details see https://developer.salesforce.com/page/Secure_Coding_Cross_Site_Scripting#S-...


4

The 'Reflected' part of reflected XSS vulnerabilities usually means that a parameter going into the page is being echoed back in the response exactly as is, the issue being that if an attacker were to put JavaScript into the parameter it'd end up on the page and being executed by the user's browser. Given that in this particular case you're outputting a ...


4

For the first scenario, there's no risk, because the code being emitted is directly created by the developer and is under the developer's full control. There's no risk of malicious injection, so there's no security risk. For the second scenario, you should escape the content that's not under your control. For example, you might do this: output += String....


3

If you want to render HTML from an Apex Controller into a component unescaped you need to make sure that there is no active content, otherwise you will have a stored cross site scripting vulnerability. Currently the only (sane) way to do this is to pull the HTML from a rich text field. This will sanitize the html and make it safe for rendering via an escape='...


3

In order to resolve this issue you will need to change the code as below <apex:OutputText value="{!question.selectedVal}" escape="false"/> To <apex:outputPanel id="richtextelement"/> <script>var richtextelement = document.getElementById('{!$Component.richtextelement}'); $(richtextelement).html($('<div/>').html('{!JSENCODE(question....


3

Regardless of the possible effort you may have made already in APEX, in my experience checkmarx is expecting always any {!...} output in visualforce to be escaped using JSENCODE, HTMLENCODE, URLENCODE - that ruleset feels quite simple. So there may be false positives and you should be able to discuss it with the security review guys. Usually I just clamp ...


2

You want HTMLENCODE, that's the correct operator for use in CSS.


2

The scanner is correct, a stored XSS attack is possible from that code. I don't believe this can be handled by HTMLENCODE() in your Visualforce. With that in mind, you probably need to use String.escapehtml4() in your controller to close the hole. Using User.Id for the value in your SelectOption isn't an issue, but if you were using a text field, some ...


2

What is type of loanId and where does it code from? Is it a String or an Id? Since you are using it to build a dynamic SOQL query you need to be extremely cautious with it. Especially since you have lots of terms like "Loan", "Bank", "Bal", "Credit_Score" in there. For example, if it was a string from the URL query string I could try setting it to ...


1

In Visualforce, both reflective and stored XSS is possible. This involves not using JSENCODE, HTMLENCODE, JSINHTMLENCODE, any standard element, or using escape="false" on elements that support the attribute. In Aura and LWC, reflective and stored XSS is "kind of" possible, but scripts cannot run in the DOM if inserted, which means visual ...


1

You will need to encode using JSENCODE and HTMLENCODE . Here is what you can do <script type="text/javascript"> $('.content').html("{!JSINHTMLENCODE(tableData)}"); ... </script>


1

I am not a security expert and this falls outside the scope of this forum, but... Yes, this certainly puts you at risk of XSS. Specifically, a man-in-the-middle attack that generates urls pointing to malicious domains. You should probably have reverse authentication for your service - e.g., a signed HTTPS cert that you verify. If all img urls are at a ...


1

A solution I have used before is to load the HTML content into a JavaScript variable and then use JQuery (or standard JavaScript) to insert the 'text' into the DOM structure in the correct place. I think I did something like:- var htmlInject = '{!HTMLENCODE(myobjdata)}'; //replace any escaped chars as necessary... $("mynode").html(htmlInject);


1

If you are using tag with attribute “escape = false” then please make sure either The value being printed is some fixed non user inputted text like <apex:outputText escape="false" value="{!"<!DOCTYPE html>"}"/> Else, value is being escaped via Apex etc using Security Coding Library escape functions or any other equivalent. For ex. String ...


1

This is a great question. An HTML Style attribute passes the value to the CSS parser, much like eventhandler attributes ('onclick') pass the value to the JS Parser. In the case of a merge-field in the value of an onclick attribute, you would use JSENCODE, but in the case of a 'style' attribute -- what do you use? Unfortunately, nothing! VisualForce does ...


1

The Checkmarx scanner is flagging "naked" (e.g. unencoded) merge-fields in a javascript context, so the following will quiet the scanner: <script type="text/javascript" charset="UTF-8"> $j = jQuery.noConflict(); $j(document).ready(function(){ $j('#h{!JSENCODE(category)}').on('click', function(event) { $j('#s{!JSENCODE(...


Only top voted, non community-wiki answers of a minimum length are eligible