2

I am having 2 pages

  1. parent page consist a link, on click of this link i am calling an javascript function

function callPage( productId ){
   var product = document.getElementById(ProductId).id;
   var OpptyId = {!oppty.Id};
   var urlToOpen = "/apex/" + '{!namespacePrefix}' + 'testPage?product='+product+'&OpptyId'=OpptyId ;

   window.open(urlToOpen ,'','resizable=0,location=0,status=0,scrollbars=0,width=850,height=350,top=100,left=220')
}

where Oppty Id is taken from controller.

  1. While in my child page I am getting all these paramiters as

ProductValueId = ApexPages.currentPage().getParameters().get('product');
opptyValue = ApexPages.currentPage().getParameters().get('OpptyId');

and these fields are then used in javascript as

function setValue()
{
    var productId = '{!productValueId}';
    window.parent.opener.document.getElementById(productId).value='{!productValue}';
}

where {!productValue} is taken from controller.

I am not understanding how and where should i make changes for soving my checkmarx issue.

So, please help me as I would want to submit the application for code review.

Best Regards

1 Answer 1

2

You are taking the query string parameter product, reading it into the productValueId controller member/property and then directly outputting it into the Visualforce page.

So basically whatever I give you on the query string ends up output into the page response.

With some effort it may be possible to encode a query string that will break out of your JavaScript and execute whatever I wan't.

E.g.

/apex/ABC__testPage?product=productId';alert('xss&OpptyId=006100000000001

Or something like that. To be fair, Visualforce will encode the expression for you.

Checkmarx has found the potential path. You will need to either remove this direct path or provide sufficient justification that it isn't open to XSS.

One helpful thing to do is enforce the data type on the values read from the query string. E.g. Explicitly use Id rather than string as the type for productValueId.

Then you could also verify that the records referenced in the query string params are actually valid for the current user. I.e. they haven't changed some of the values to gain access to records they otherwise shouldn't see.

Incidentally, the Salesforce StackExchange is a great place to ask Salesforce specific questions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.