Skip to main content

Cross-Site Scripting (XSS)

When a malicious html script or client side script is provided to a web application, it is called as cross-site scripting.

However, Salesforce has a special feature wherein, all standard Visual Force components, which starts with <apex> have an anti-XSS filter in place.

To disable the protection on Visual force tag
<apex: outputText escape="false" value="{!$CurrentPage.parameters.userInput}"/>

Focus on the escape="false", because due to this the security provided by Salesforce is bypassed and the code becomes vulnerable to an XSS attack again.

In general, a code is vulnerable to an XSS attack if it takes user input and outputs it directly back to the user.
Labels:

Comments

Post a Comment

Popular posts from this blog

Cross-Site Request Forgery (CSRF)

CSRF occurs when an attacker's webpage contains URL that performs action on website. Suppose the user is logged into a webpage and they visit an attacker's webpage simultaneously, the URL is retrieved by the attacker and actions are performed. (Hence it is advisable to log out first before opening other websites.) In Lightning platform, Salesforce has implemented an anti-CSRF token to prevent this attack. It uses tokens for authentication. Suggestions for best practices:  Add a confirmation page/pop up before action. Shorten the idle session timeout. Logout of active session and not use browser to visit other sites while authenticated. In Salesforce, built-in defence against CSRF is present. If user is logged in on one tab and attempts in another, they will see this error: "The page you submitted was invalid for your session." However, users can log in by refreshing the login page or attempting to log in a second time.
Post a Comment
Read more

Event Monitoring

Event monitoring is used to keep track of logins, logoutw, web clicks, API calls, VF page loads, apex executions and reporte exports. All these events are stored in event log files. Each org's event log files are stored in API object called EventLog File.
Post a Comment
Read more

Connected App

 A connected app is a framework that enables an external application to integrate with Salesforce using APIs and standard protocols, such as SAML, OAuth, and OpenID Connect. Connected apps use these protocols to authenticate, authorize, and provide single sign-on (SSO) for external apps. The external apps that are integrated with Salesforce can run on the customer success platform, other platforms, devices, or SaaS subscriptions. For example, when you log in to your Salesforce mobile app and see your data from your Salesforce org, you’re using a connected app. https://help.salesforce.com/articleView?id=sf.connected_app_overview.htm&type=5 By capturing metadata about an external app, a connected app tells Salesforce which protocol—SAML, OAuth, and OpenID Connect—the external app uses, and where the external app runs. Salesforce can then grant the external app access to its data, and attach policies that define access restrictions, such as when the app’s access expires. Salesforc...
Post a Comment
Read more