Skip to main content
Topics#SecurityQuestion de Elavarasi Elangovan
Elavarasi Elangovan a posé une question dans #Security
18 juin 2015, 19:47

Security Review XSRF issue on Apex class

Unable to install Managed Package(contains Visual Force Page,Apex class,Custom Button or Link,static Resource) on Professional Edition..We submitted the package for security review. But we got the report with XSRF issue. On clicking the Custom Button or Link on opportunity layout, the VF page is rendered as PDF and open as new window.We used "ApexPages.currentPage().getParameters().get('id'); " to get Opportunity Id

Can you please help us to resolve the XSRF issue on Apex class?
1 réponse
  1. Sarfarajey Akram Mir (Ford Motor Company)
    21 juin 2015, 18:24
    As you are not performing any DML operation I think the issue is less severe. Please make sure you are assigning the value "ApexPages.currentPage().getParameters().get('id');" to a variable of type Id before using it. Please don't use any get parameter directly into any SOQL. First assign and then use the variable. Also if the parameter is ID assign it to a variable of type Id. If it is String you may consider escaping the single-quotes. String class has some nice utility methods.

    Second thing you should take care is marking the class with sharing. As you are using a get parameter to generate the output, the controller in without sharing mode will be a weak point in terms of security.

    If possible make this request a POST instead of GET. 

    Here are some reference for you,

    As you are not performing any DML operation I think the issue is less severe. Please make sure you are assigning the value

    References

    http://www.owasp.org/index.php/Cross-Site_Request_Forgery

    http://www.cgisecurity.com/articles/csrf-faq.shtml

    http://shiflett.org/articles/cross-site-request-forgeries

    --Akram
Rédiger une réponse...
0/9000