Skip to main content

Cross-Site Scripting (XSS)

When a malicious html script or client side script is provided to a web application, it is called as cross-site scripting.

However, Salesforce has a special feature wherein, all standard Visual Force components, which starts with <apex> have an anti-XSS filter in place.

To disable the protection on Visual force tag
<apex: outputText escape="false" value="{!$CurrentPage.parameters.userInput}"/>

Focus on the escape="false", because due to this the security provided by Salesforce is bypassed and the code becomes vulnerable to an XSS attack again.

In general, a code is vulnerable to an XSS attack if it takes user input and outputs it directly back to the user.
Labels:

Comments

Post a Comment

Popular posts from this blog

Connected App

 A connected app is a framework that enables an external application to integrate with Salesforce using APIs and standard protocols, such as SAML, OAuth, and OpenID Connect. Connected apps use these protocols to authenticate, authorize, and provide single sign-on (SSO) for external apps. The external apps that are integrated with Salesforce can run on the customer success platform, other platforms, devices, or SaaS subscriptions. For example, when you log in to your Salesforce mobile app and see your data from your Salesforce org, you’re using a connected app. https://help.salesforce.com/articleView?id=sf.connected_app_overview.htm&type=5 By capturing metadata about an external app, a connected app tells Salesforce which protocol—SAML, OAuth, and OpenID Connect—the external app uses, and where the external app runs. Salesforce can then grant the external app access to its data, and attach policies that define access restrictions, such as when the app’s access expires. Salesforc...
Post a Comment
Read more