9
votes
Accepted
How to JSENCODE from an apex controller?
You can use JSENCODE in tandem with the built-in Javascript method JSON.parse.
var myEscapedObject = JSON.parse("{!JSENCODE(serializedOptions)}");
- 142k
7
votes
How do I fix Stored XSS and Reflected XSS?
Lets first understand what is XSS and see what are the possible ways to prevent this
Cross-site scripting(XSS) is a vulnerability that occurs when an attacker can insert unauthorized JavaScript, ...
- 85.9k
6
votes
Accepted
Why are there 3 functions to encode in Visualforce?
Note that there are four encoding functions, not three. You forgot about URLENCODE. Here's an article that would really help you to read: Unescaped Output and Formulas in Visualforce Pages.
If you ...
- 142k
5
votes
Accepted
How do I fix this Stored XSS vulnerability?
I believe its because you are using an unescaped output in your JS
$j('#h{!category}').css("background-color","{!entity.CPHeader__c}");
. Instead use the JSENCODE formula
$j('#h{!category}').css("...
- 1,809
4
votes
Accepted
How to avoid security risks with escape="False" in output tags
For the first scenario, there's no risk, because the code being emitted is directly created by the developer and is under the developer's full control. There's no risk of malicious injection, so there'...
- 430k
4
votes
Accepted
How do I fix this Reflected XSS vulnerability?
The 'Reflected' part of reflected XSS vulnerabilities usually means that a parameter going into the page is being echoed back in the response exactly as is, the issue being that if an attacker were to ...
- 24.7k
4
votes
Accepted
What are some use cases for HTMLENCODE?
The documentation you've linked to is pretty clear. Any time you are trying to output data that could include untrusted html, you should use HTMLENCODE.
HTMLENCODE
Encodes text and merge field ...
- 142k
3
votes
Accepted
Make Visualforce variable in Javascript pass Security Review
This is clearly a false positive as you are not using any JavaScript from the CDN. Since the JavaScript is within the Visualforce Page it should be ok.
Disclaimer : Please consult with the Salesforce ...
- 85.9k
3
votes
Accepted
How to escape HTML or AMPscript in AMPscript variables?
You don't need to escape AmpScript in variables unless you explicitly ask the platform to render it by wrapping it in TreatAsContent. Example:
%%[ SET @Firstname = "%%=add(2,2)=%%" ]%%
We can ...
- 16.9k
3
votes
Accepted
Why use ESAPI for encoding?
The short answer: ESAPI is for security, preventing deliberate attacks; Apex escapeHTML, etc. is for ensuring html displays properly.
Cross site scripting
Do not use the built in Apex String ...
- 191
3
votes
How to test XSS/Content Sniffing protection in sandbox?
According to Platform Security FAQS.
X-Content-Type-Options: no sniff
The HTTP header can be turned on or off by each organization under Setup > Security Controls > Session Settings > ...
- 98.2k
3
votes
"Client Cross Frame Scripting Attack" by Checkmarx Scanner for Visualforce component
This looks like a false positive. There are false positives with every query, of course, and we regularly review these queries. Going forward, we are going to remove this query from our security ...
- 3,108
2
votes
How do I fix this Stored XSS?
You want HTMLENCODE, that's the correct operator for use in CSS.
- 23.8k
2
votes
Accepted
Making existing page XSS proof for Lightning Experience
It's already XSS-proof. You're not merging in anything that could be abused. The only reason you'd want JSENCODE is if you were using a merge field, which you could have:
<script>
window....
- 430k
2
votes
Lightning DOM XSS Injection Issue Reported in Checkmarx
The iframe src attribute can be used to execute malicious javascript code (see here). For example, testDummyurl could equal the code below, which would cause an alert message to appear when the user ...
- 316
1
vote
Package review fails with new undocumented issues
Why don't those appear in my own Checkmarx / Security Scanner runs?
Possibly false negatives? It's hard to tell without seeing the code in question and the scanner results; you may need to log a bug ...
- 430k
1
vote
Accepted
XSS in the content assets in SFCC
Frankly, I think that document you referenced was placed in the wrong location. It has nothing to do with Content Assets except that a developer outputting a content asset content must ensure they ...
- 582
1
vote
How to xss attack here
It depends on what you're doing with this; poorly written JavaScript libraries that don't escape and use innerHTML can fall victim to an XSS. However, that requires some extra effort. The code, as ...
- 430k
1
vote
What are some use cases for HTMLENCODE?
For example, suppose you have a string that contains HTML code including code that mentioned in this link http://f2.org/links/webauth/entities.html#html3
SO, in this case, you may want to render that ...
- 22k
1
vote
How to prevent DOM XSS Vulnerability for this script -
You will need to encode using JSENCODE and HTMLENCODE .
Here is what you can do
<script type="text/javascript">
$('.content').html("{!JSINHTMLENCODE(tableData)}"); ...
</script>
- 85.9k
1
vote
Setting X-XSS-Protection response headers in Apex has no effect
I believe that ApexPages.currentPage().getHeaders() returns the request headers, which should be read only at this point.
As far as I can see there is no way to set response headers.
- 11
1
vote
What are some use cases for HTMLENCODE?
Say you want to pass values through a URL like a button, When creating a new record. You can type field_name__c = {!merge_field__c} and everything is all good if it's one word.
Say you want to pass ...
- 3,334
1
vote
Accepted
Getting Image Url From REST - Security Threat?
I am not a security expert and this falls outside the scope of this forum, but...
Yes, this certainly puts you at risk of XSS. Specifically, a man-in-the-middle attack that generates urls pointing ...
- 4,062
1
vote
How do I fix this Stored XSS?
This is a great question. An HTML Style attribute passes the value to the CSS parser, much like eventhandler attributes ('onclick') pass the value to the JS Parser.
In the case of a merge-field in ...
- 3,108
1
vote
How do I fix this Stored XSS vulnerability?
The Checkmarx scanner is flagging "naked" (e.g. unencoded) merge-fields in a javascript context, so the following will quiet the scanner:
<script type="text/javascript" charset="UTF-8">
$j =...
- 3,108
Only top scored, non community-wiki answers of a minimum length are eligible