Apex addError Without Escaping: XSS Risk in Salesforce

Calls To addError With Disabled Escaping Should Be Avoided

Impact Area

Security

Severity

High

Affected Element

Apex Class

Rule ID #

SF-0021

Impact #

The message passed to addError will be displayed directly to the user in the UI, making it prime ground for XSS attacks if unescaped.

Remediation #

Ensure that all calls to the addError function are escaped.

Time to fix #

60 min

Was it helpful ?

Still stuck? How can we help?

Table of contents

Rule ID
Impact
Remediation
- Time to fix

THE AI CODE GOVERNANCE BRIEF

Sign up for new updates!