Skip to content

Commit 9de623f

Browse files
tprouvottprouvot
committed
Fix XSS vulnerability
1 parent 4ba6037 commit 9de623f

File tree

2 files changed

+56
-45
lines changed

2 files changed

+56
-45
lines changed

‎sfdx-source/LabsActionPlans/main/default/components/APLightningLookup.component‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ For full license text, see the LICENSE file in the repo root or https://opensour
100100
alert(event.message);
101101
}
102102
},
103-
{ escape: false }
103+
{ escape: true }
104104
);
105105
},
106106
searchRecords: function (key, sObjType, cObject) {
@@ -116,13 +116,15 @@ For full license text, see the LICENSE file in the repo root or https://opensour
116116
var searchList = "";
117117
//Creating List Elements Based on Query Results
118118
var searchIcon = '{!URLFOR($Asset.SLDS, "assets/icons/utility-sprite/svg/symbols.svg#search")}';
119+
// Escape HTML to prevent XSS attacks
120+
var escapedSearchKey = j$('<div>').text(searchKey).html();
119121
searchList += '<li role="presentation" class="slds-listbox__item">' +
120122
'<div aria-selected="true" id="option0" class="slds-media slds-listbox__option slds-listbox__option_entity slds-listbox__option_term slds-has-focus" role="option">' +
121123
'<span class="slds-media__figure slds-listbox__option-icon">' +
122124
'<span class="slds-icon_container slds-icon-utility-search" title="{!$Label.ap_Search}:">' +
123125
'<svg class="slds-icon slds-icon_x-small slds-icon-text-default" aria-hidden="true"><use xlink:href="' + searchIcon + '"></use></svg>' +
124126
'<span class="slds-assistive-text">{!$Label.ap_Search}:</span></span></span>' +
125-
'<span class="slds-media__body"><span class="slds-listbox__option-text slds-listbox__option-text_entity">' + searchKey + '</span></span></div > ' +
127+
'<span class="slds-media__body"><span class="slds-listbox__option-text slds-listbox__option-text_entity">' + escapedSearchKey + '</span></span></div > ' +
126128
'</li>';
127129
//Call secure search method with separate parameters
128130
var records = [];
@@ -150,9 +152,15 @@ For full license text, see the LICENSE file in the repo root or https://opensour
150152
objectIcon = '{!URLFOR($Asset.SLDS, "assets/icons/standard-sprite/svg/symbols.svg#' + iconTag + '")}';
151153
}
152154

153-
searchList += '<li onclick="LightningLookupScripts{!for}.recInfo(\'' + records[i].Id + '\'' + ', \'' + sObjType.toLowerCase() + '\');" class="slds-lookup__item">';
154-
searchList += '<a id="' + records[i].Id + '" href="#" role="option"><svg aria-hidden="true" class="slds-icon ' + iconStyle + ' slds-icon_small">'
155-
+ '<use xlink:href="' + objectIcon + '"></use></svg>' + records[i]["{!JSENCODE(displayField)}"] + '</a>';
155+
// Escape HTML and JavaScript to prevent XSS attacks
156+
var escapedId = j$('<div>').text(records[i].Id).html();
157+
var escapedDisplayField = j$('<div>').text(records[i]["{!JSENCODE(displayField)}"]).html();
158+
var escapedIdForJS = escapedId.replace(/'/g, "\\'");
159+
var escapedSObjType = sObjType.toLowerCase().replace(/'/g, "\\'");
160+
161+
searchList += '<li onclick="LightningLookupScripts{!for}.recInfo(\'' + escapedIdForJS + '\'' + ', \'' + escapedSObjType + '\');" class="slds-lookup__item">';
162+
searchList += '<a id="' + escapedId + '" href="#" role="option"><svg aria-hidden="true" class="slds-icon ' + iconStyle + ' slds-icon_small">'
163+
+ '<use xlink:href="' + objectIcon + '"></use></svg>' + escapedDisplayField + '</a>';
156164
searchList += '</li>';
157165
}
158166
} else {
@@ -167,7 +175,7 @@ For full license text, see the LICENSE file in the repo root or https://opensour
167175
alert(event.message);
168176
}
169177
},
170-
{ escape: false }
178+
{ escape: true }
171179
);
172180
}
173181
}

‎sfdx-source/LabsActionPlans/main/default/pages/ActionPlanCreation.page‎

Lines changed: 42 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -189,50 +189,53 @@ For full license text, see the LICENSE file in the repo root or https://opensour
189189
alert(event.message);
190190
}
191191
},
192-
{ escape: false }
192+
{ escape: true }
193193
);
194194
},
195-
searchRecords: function (key) {
196-
j$('#' + key.attr('aria-activedescendant')).show();
197-
//Grabbing The Input Field Value
198-
var searchKey = key.val();
199-
if (searchKey == '') {
200-
j$('#' + key.attr('aria-activedescendant')).hide();
201-
}
202-
var searchList = '';
203-
Visualforce.remoting.Manager.invokeAction(
204-
'{!$RemoteAction.ActionPlanCreationController.searchTemplates}',
205-
searchKey,
206-
function (result, event) {
207-
if (event.status) {
208-
records = result;
209-
if (records.length > 0) {
210-
for (var i = 0; i < records.length; i++) {
211-
//List Elements With Onclick and ID Attributes
212-
var objectIcon = '{!URLFOR($Asset.SLDS, "assets/icons/custom-sprite/svg/symbols.svg#custom39")}';
213-
searchList +=
214-
'<li onclick="LightningLookupScripts.recInfo(\'' +
215-
records[i].Id +
216-
'\');" class="slds-lookup__item"><a id="' +
217-
records[i].Id +
218-
'" href="#" role="option"><svg aria-hidden="true" class="slds-icon slds-icon-custom-custom39 slds-icon_small">' +
219-
'<use xlink:href="' +
220-
objectIcon +
221-
'"></use></svg>' +
222-
records[i].Name +
223-
'</a></li>';
224-
}
225-
} else {
226-
searchList += '<li class="slds-lookup__item">No Records Found</li>';
195+
searchRecords: function (key) {
196+
j$('#' + key.attr('aria-activedescendant')).show();
197+
//Grabbing The Input Field Value
198+
var searchKey = key.val();
199+
if (searchKey == '') {
200+
j$('#' + key.attr('aria-activedescendant')).hide();
201+
}
202+
var searchList = '';
203+
Visualforce.remoting.Manager.invokeAction(
204+
'{!$RemoteAction.ActionPlanCreationController.searchTemplates}',
205+
searchKey,
206+
function (result, event) {
207+
if (event.status) {
208+
records = result;
209+
if (records.length > 0) {
210+
for (var i = 0; i < records.length; i++) {
211+
//List Elements With Onclick and ID Attributes
212+
var objectIcon = '{!URLFOR($Asset.SLDS, "assets/icons/custom-sprite/svg/symbols.svg#custom39")}';
213+
// Escape HTML to prevent XSS attacks
214+
var escapedName = j$('<div>').text(records[i].Name).html();
215+
var escapedId = j$('<div>').text(records[i].Id).html();
216+
searchList +=
217+
'<li onclick="LightningLookupScripts.recInfo(\'' +
218+
escapedId.replace(/'/g, "\\'") +
219+
'\');" class="slds-lookup__item"><a id="' +
220+
escapedId +
221+
'" href="#" role="option"><svg aria-hidden="true" class="slds-icon slds-icon-custom-custom39 slds-icon_small">' +
222+
'<use xlink:href="' +
223+
objectIcon +
224+
'"></use></svg>' +
225+
escapedName +
226+
'</a></li>';
227227
}
228-
j$('[id$=searchResultsUL]').html(searchList);
229228
} else {
230-
alert(event.message);
229+
searchList += '<li class="slds-lookup__item">No Records Found</li>';
231230
}
232-
},
233-
{ escape: false }
234-
);
235-
}
231+
j$('[id$=searchResultsUL]').html(searchList);
232+
} else {
233+
alert(event.message);
234+
}
235+
},
236+
{ escape: true }
237+
);
238+
}
236239
};
237240
checkinput();
238241
</script>

0 commit comments

Comments
 (0)