Reflected XSS and Stored XSS in checmarx - salesforce

Question

I am having 2 pages
parent page consist a link, on click of this link i am calling an javascript function
function callPage( productId ){
var product = document.getElementById(ProductId).id;
var OpptyId = {!oppty.Id};
var urlToOpen = "/apex/" + '{!namespacePrefix}' + 'testPage?product='+product+'&OpptyId'=OpptyId ;
window.open(urlToOpen ,'','resizable=0,location=0,status=0,scrollbars=0,width=850,height=350,top=100,left=220')
}
where Oppty Id is taken from controller.
While in my child page I am getting all these paramiters as
ProductValueId = ApexPages.currentPage().getParameters().get('product');
opptyValue = ApexPages.currentPage().getParameters().get('OpptyId');
and these fields are then used in javascript as
function setValue()
{
var productId = '{!productValueId}';
window.parent.opener.document.getElementById(productId).value='{!productValue}';
}
where {!productValue} is taken from controller.
I am not understanding how and where should i make changes for soving my checkmarx issue.
So, please help me as I would want to submit the application for code review.
Best Regards

Answer 1

You are taking the query string parameter product, reading it into the productValueId controller member/property and then directly outputting it into the Visualforce page.
So basically whatever I give you on the query string ends up output into the page response.
With some effort it may be possible to encode a query string that will break out of your JavaScript and execute whatever I wan't.
E.g.
/apex/ABC__testPage?product=productId';alert('xss&OpptyId=006100000000001
Or something like that. To be fair, Visualforce will encode the expression for you.
Checkmarx has found the potential path. You will need to either remove this direct path or provide sufficient justification that it isn't open to XSS.
One helpful thing to do is enforce the data type on the values read from the query string. E.g. Explicitly use Id rather than string as the type for productValueId.
Then you could also verify that the records referenced in the query string params are actually valid for the current user. I.e. they haven't changed some of the values to gain access to records they otherwise shouldn't see.
Incidentally, the Salesforce StackExchange is a great place to ask Salesforce specific questions.