PDI · Question #231
Which code in a Visualforce page and/or controller might present a security vulnerability?
The correct answer is B. <apex:outputText escape="false" value="{!sCurrentPage.parameters.userInput}TM />. The question asks to identify a Visualforce code snippet that might introduce a security vulnerability, specifically cross-site scripting (XSS).
Question
Which code in a Visualforce page and/or controller might present a security vulnerability?
Options
- A<apex:outputfield value="(!ctrl.userinput)" rendered="(!isfditable}" />
- B<apex:outputText escape="false" value="{!sCurrentPage.parameters.userInput}TM />
- C<apex:outputField value="{'ctrl.userInput}" />
- D<apex:outputText value="{!SCurrentPage.parameters.useriInput}" />
How the community answered
(47 responses)- A2% (1)
- B81% (38)
- C6% (3)
- D11% (5)
Why each option
The question asks to identify a Visualforce code snippet that might introduce a security vulnerability, specifically cross-site scripting (XSS).
The `<apex:outputField>` component automatically escapes its output by default, providing protection against XSS vulnerabilities.
The `<apex:outputText escape="false" ...>` component explicitly disables HTML escaping. If `sCurrentPage.parameters.userInput` contains malicious script injected from the URL, it will be rendered directly into the page, leading to a Cross-Site Scripting (XSS) vulnerability.
The `<apex:outputField>` component automatically escapes its output, protecting against XSS vulnerabilities.
The `<apex:outputText>` component by default has `escape="true"`, meaning it automatically HTML-escapes its output, rendering any malicious script harmlessly as plain text.
Concept tested: Visualforce security and XSS vulnerabilities
Source: https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_security_xss.htm
Topics
Community Discussion
No community discussion yet for this question.