salesforce_security_impl_guide

Security Tips for Apex and Visualforce Development
Formula Tags
Formula Tags
The general syntax of these tags is: {!FUNCTION()} or {!$OBJECT.ATTRIBUTE} . For example, if a developer wanted to
include a user's session ID in a link, they could create the link using the following syntax:
Go to portal
Which renders output similar to the following:
Go to portal
Formula expressions can be function calls or include information about platform objects, a user's environment, system environment,
and the request environment. An important feature of these expressions is that data is not escaped during rendering. Since expressions
are rendered on the server, it is not possible to escape rendered data on the client using JavaScript or other client-side technology. This
can lead to potentially dangerous situations if the formula expression references non-system data (that is potentially hostile or editable
data) and the expression itself is not wrapped in a function to escape the output during rendering. A common vulnerability is created
by the use of the {!$Request.*} expression to access request parameters.
{!$Request.title}
Hello world!
Unfortunately, the unescaped {!$Request.title} tag also results in a cross-site scripting vulnerability. For example, the request:
http://example.com/demo/hello.htmltitle=Adios%3C%2Ftitle%3E%3Cscript%3Ealert('xss')%3C%2Fscript%3E
results in the output:
Adiosalert('xss')Hello
world!
The standard mechanism to do server-side escaping is through the use of the SUBSTITUTE() formula tag. Given the placement of
the {!$Request.*} expression in the example, the above attack can be prevented by using the following nested SUBSTITUTE()
calls.
{! SUBSTITUTE(SUBSTITUTE($Request.title,"")}
Hello world!
Depending on the placement of the tag and usage of the data, both the characters needing escaping, as well as their escaped counterparts,
can vary. For instance, this statement:
var ret = "{!$Request.retURL}";script>var ret = "{!$Request.retURL}";
102