function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
Anuj Joshi 42Anuj Joshi 42 

Escaping in vf page

Hi All,

I have a line of code which is written like this. 
<apex:outputText escape="False" value="{!cr.Message__c}" rendered="{!(cr.Message__c)!= ''}"/><br/><br/>
I am getting an issue in the checkmarx report saying that this line is vulnerable to Cross site scripting (XSS). When i convert the above line to  
<apex:outputText escape="False" value="{!HTMLENCODE(cr.Message__c)}" rendered="{!HTMLENCODE(cr.Message__c)!= ''}"/>

I am getting a output as <p> Hi <br/> ...in this format. Kindly help me to resolve this issue. Actually I am displaying the emailmeesage content in this vf page and diplaying in case related list.

Thanks,
Anuj
 
Dushyant SonwarDushyant Sonwar
Hi Anuj,

Try Changing it to outputField and remove escape false , it will automatically handle the vulnerablithy attacks. 
<apex:outputField value="{!cr.Message__c}" rendered="{!cr.Message__c!= ''}"/>
Hope this helps.
Anuj Joshi 42Anuj Joshi 42
Hi dushyant,

Its a rich text area field.

Thanks,
Anuj
Dushyant SonwarDushyant Sonwar
Hi Anuj ,

Rich Text Area Fields are safe types to render as per salesforce secure coding guidelines . Output Field tag will automatically encode unsafe characters.
https://salesforce.stackexchange.com/questions/106593/xss-rich-textarea-content-security-review-issue-when-using-escape-false