Apex Code Development You need to sign in to do that
Don't have an account?
Escape the label attribute of apex:inputField elements to prevent cross-site scripting in Visualforce pages Release Update
Release Update of Escape the label attribute of apex:inputField elements to prevent cross-site scripting in Visualforce pages (https://help.salesforce.com/s/articleView?id=release-notes.rn_vf_escape_apex_inputField_label_ru.htm&type=5&release=240)
apex:inputfield doesn't contain escape=false as an attribute, does the realease update referring to escape as an escape string ex : \"Account\" .
How can i test the above release update
This release update applies to only the label attribute of the apex:inputField element in visualforce pages. To test this update, you can follow the below steps.
[1] You can review the code to check the label attribute of the apex:inputField element is escaped or not.
Reference Articles for a list of functions that are commonly used for escaping strings :
https://developer.salesforce.com/docs/atlas.en-us.240.0.pages.meta/pages/pages_security_tips_scontrols.htm
Enable the release update in a sandbox and assess its impact on your apex:inputField elements. After you enable this update for testing, verify that the custom text from your label attributes of the apex:inputField renders correctly on your Visualforce pages.
[2] After it’s enabled, this update escapes all existing label attributes of your apex:inputField elements on all of your Visualforce pages. Labels that you already escaped will be double-escaped after you enable this update. Double-escaped labels don’t render correctly on your Visualforce pages.
Create a list of all the Visualforce pages that incorrectly render text from double-escaped label attributes.
[3] Use your list of Visualforce pages with double-escaped custom labels from Step 2 to remove your manual escaping from all of your label attributes. Remember to save each Visualforce page after you change your code.
In summary, different methods are used to escape the label attribute of the apex:inputField element mentioned in the above link. You need to identify all the apex:inputField elements whose label is escaped before enabling the update. After the update is enabled, you need to test all the VF pages if they are rendering properly. If not, verify apex:inputField elements and remove your manual escaping code from label attributes.
Please mark this as Best Answer if it was Helpful .
Thank you .