Avoid Malicious JavaScript in Lists

Search for a command to run...

No comments yet. Be the first to comment.
Context is one of the most important things when working with AI. That's kind of the agent "memory" during the session. A key part of the context giving the agent instructions on what to use for speci

A new Data Source was included in this release, you can see it when including a new component, it's called "Sample Data" Some components like maps, charts and Calendar have this source type now, that

This is a great combination for something the used to take some effort on writing some functions to execute actions on specific rows of an IR, like using a hidden page item, assigning the PK value of

Creation of a parallel translated app is no longer the only way to handle multiple languages in APEX. Now under Globalization Attributes, we can select "Text Message-Based" as Translation Method. On

Recently, I created an APP using APEXlang, (check here). I asked the agent to create a lookup table including columns to store colors and icons, useful to work with status for example. The agent no on

Recently I was asked to review and test an APEX application to fulfill the security team requirements before we can publish it, making an emphasis in escaping special characters.
In General, APEX takes care of this. If you see the attributes of an Page Item or a Region, you're going to find a switch (On by default) to escape especial characters, but we found an exception.
So the scenario would be this, let's say we create a simple list based on a query like the one shown bellow

Then add this list to a region displayed as links list


So the example looks like this:

Now, if you allow users to insert data that is going to be shown in a list, here is where the issue comes up. Let's use a form to add a new profile

The new record shows correctly here

Now let's add another record, this time adding some JavaScript conde and see what happens


JavaScript code was executed!! Execution happens when the list region is loaded. As you can see bellow, after closing the alert, the script characters are not escaped in the list. And we don't have an attribute to avoid this behavior.

But don't worry, there is a solution. APEX comes with a series of packages and API's to help us, one of them is apex_escape that "provides functions for escaping special characters in strings to ensure that the data is suitable for further processing".
So, let's add to our query apex_escape.html function and see how the output changes.


Now we can see the special characters being escaped in the list, and that piece of code is no longer executed.