PDI · Question #77
A developer has a Apex controller for a Visualforce page that takes an ID as a URL parameter. How should the developer prevent a cross site scripting vulnerability?
The correct answer is B. ApexPages.currentPage() .getParameters() .get('url_param') .escapeHtml4(). To prevent cross-site scripting (XSS) vulnerabilities when displaying user-controlled input, such as URL parameters, on a Visualforce page, the input must be properly escaped.
Question
A developer has a Apex controller for a Visualforce page that takes an ID as a URL parameter. How should the developer prevent a cross site scripting vulnerability?
Options
- AApexPages.currentPage() .getParameters() .get('url_param')
- BApexPages.currentPage() .getParameters() .get('url_param') .escapeHtml4()
- CString.ValueOf(ApexPages.currentPage() .getParameters() .get('url_param'))
- DString.escapeSingleQuotes(ApexPages.currentPage() .getParameters(). get('url_param'))
How the community answered
(35 responses)- A9% (3)
- B71% (25)
- C17% (6)
- D3% (1)
Why each option
To prevent cross-site scripting (XSS) vulnerabilities when displaying user-controlled input, such as URL parameters, on a Visualforce page, the input must be properly escaped.
Retrieving the parameter without any escaping leaves the application vulnerable to XSS if the parameter contains malicious script.
To prevent XSS, any user-supplied input that is displayed back on a web page must be properly escaped. The `escapeHtml4()` method escapes special characters in HTML, such as `<`, `>`, `&`, and `"`, converting them into their HTML entity equivalents, thereby neutralizing any malicious script tags.
`String.valueOf()` converts the parameter to a string but does not perform any HTML escaping, leaving the XSS vulnerability open.
`String.escapeSingleQuotes()` is used to escape single quotes, primarily for safely incorporating user input into dynamic SOQL queries to prevent SOQL injection, not for preventing XSS in displayed HTML.
Concept tested: XSS prevention (HTML escaping)
Source: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_string.htm#apex_System_String_escapeHtml4
Topics
Community Discussion
No community discussion yet for this question.