Hot answers tagged

9 votes
Accepted

How to JSENCODE from an apex controller?

You can use JSENCODE in tandem with the built-in Javascript method JSON.parse. var myEscapedObject = JSON.parse("{!JSENCODE(serializedOptions)}");
user avatar
  • 142k
7 votes

How do I fix Stored XSS and Reflected XSS?

Lets first understand what is XSS and see what are the possible ways to prevent this Cross-site scripting(XSS) is a vulnerability that occurs when an attacker can insert unauthorized JavaScript, ...
user avatar
6 votes
Accepted

Why are there 3 functions to encode in Visualforce?

Note that there are four encoding functions, not three. You forgot about URLENCODE. Here's an article that would really help you to read: Unescaped Output and Formulas in Visualforce Pages. If you ...
user avatar
  • 142k
5 votes
Accepted

How do I fix this Stored XSS vulnerability?

I believe its because you are using an unescaped output in your JS $j('#h{!category}').css("background-color","{!entity.CPHeader__c}"); . Instead use the JSENCODE formula $j('#h{!category}').css("...
user avatar
  • 1,809
4 votes
Accepted

How to avoid security risks with escape="False" in output tags

For the first scenario, there's no risk, because the code being emitted is directly created by the developer and is under the developer's full control. There's no risk of malicious injection, so there'...
user avatar
  • 430k
4 votes
Accepted

How do I fix this Reflected XSS vulnerability?

The 'Reflected' part of reflected XSS vulnerabilities usually means that a parameter going into the page is being echoed back in the response exactly as is, the issue being that if an attacker were to ...
user avatar
  • 24.7k
4 votes
Accepted

What are some use cases for HTMLENCODE?

The documentation you've linked to is pretty clear. Any time you are trying to output data that could include untrusted html, you should use HTMLENCODE. HTMLENCODE Encodes text and merge field ...
user avatar
  • 142k
3 votes
Accepted

Make Visualforce variable in Javascript pass Security Review

This is clearly a false positive as you are not using any JavaScript from the CDN. Since the JavaScript is within the Visualforce Page it should be ok. Disclaimer : Please consult with the Salesforce ...
user avatar
3 votes
Accepted

How to escape HTML or AMPscript in AMPscript variables?

You don't need to escape AmpScript in variables unless you explicitly ask the platform to render it by wrapping it in TreatAsContent. Example: %%[ SET @Firstname = "%%=add(2,2)=%%" ]%% We can ...
user avatar
  • 16.9k
3 votes
Accepted

Why use ESAPI for encoding?

The short answer: ESAPI is for security, preventing deliberate attacks; Apex escapeHTML, etc. is for ensuring html displays properly. Cross site scripting Do not use the built in Apex String ...
user avatar
3 votes

How to test XSS/Content Sniffing protection in sandbox?

According to Platform Security FAQS. X-Content-Type-Options: no sniff The HTTP header can be turned on or off by each organization under Setup > Security Controls > Session Settings > ...
user avatar
3 votes

"Client Cross Frame Scripting Attack" by Checkmarx Scanner for Visualforce component

This looks like a false positive. There are false positives with every query, of course, and we regularly review these queries. Going forward, we are going to remove this query from our security ...
user avatar
2 votes

How do I fix this Stored XSS?

You want HTMLENCODE, that's the correct operator for use in CSS.
user avatar
2 votes
Accepted

Making existing page XSS proof for Lightning Experience

It's already XSS-proof. You're not merging in anything that could be abused. The only reason you'd want JSENCODE is if you were using a merge field, which you could have: <script> window....
user avatar
  • 430k
2 votes

Lightning DOM XSS Injection Issue Reported in Checkmarx

The iframe src attribute can be used to execute malicious javascript code (see here). For example, testDummyurl could equal the code below, which would cause an alert message to appear when the user ...
user avatar
1 vote

Package review fails with new undocumented issues

Why don't those appear in my own Checkmarx / Security Scanner runs? Possibly false negatives? It's hard to tell without seeing the code in question and the scanner results; you may need to log a bug ...
user avatar
  • 430k
1 vote
Accepted

XSS in the content assets in SFCC

Frankly, I think that document you referenced was placed in the wrong location. It has nothing to do with Content Assets except that a developer outputting a content asset content must ensure they ...
user avatar
1 vote

How to xss attack here

It depends on what you're doing with this; poorly written JavaScript libraries that don't escape and use innerHTML can fall victim to an XSS. However, that requires some extra effort. The code, as ...
user avatar
  • 430k
1 vote

What are some use cases for HTMLENCODE?

For example, suppose you have a string that contains HTML code including code that mentioned in this link http://f2.org/links/webauth/entities.html#html3 SO, in this case, you may want to render that ...
user avatar
1 vote

How to prevent DOM XSS Vulnerability for this script -

You will need to encode using JSENCODE and HTMLENCODE . Here is what you can do <script type="text/javascript"> $('.content').html("{!JSINHTMLENCODE(tableData)}"); ... </script>
user avatar
1 vote

Setting X-XSS-Protection response headers in Apex has no effect

I believe that ApexPages.currentPage().getHeaders() returns the request headers, which should be read only at this point. As far as I can see there is no way to set response headers.
user avatar
  • 11
1 vote

What are some use cases for HTMLENCODE?

Say you want to pass values through a URL like a button, When creating a new record. You can type field_name__c = {!merge_field__c} and everything is all good if it's one word. Say you want to pass ...
user avatar
  • 3,334
1 vote
Accepted

Getting Image Url From REST - Security Threat?

I am not a security expert and this falls outside the scope of this forum, but... Yes, this certainly puts you at risk of XSS. Specifically, a man-in-the-middle attack that generates urls pointing ...
user avatar
1 vote

How do I fix this Stored XSS?

This is a great question. An HTML Style attribute passes the value to the CSS parser, much like eventhandler attributes ('onclick') pass the value to the JS Parser. In the case of a merge-field in ...
user avatar
1 vote

How do I fix this Stored XSS vulnerability?

The Checkmarx scanner is flagging "naked" (e.g. unencoded) merge-fields in a javascript context, so the following will quiet the scanner: <script type="text/javascript" charset="UTF-8"> $j =...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible