Checkmarx Security Scanning With Example

The checkmarx code scanner will check your entire business logic including client side and server-side codes. Based on your code quality, best practice standards, and vulnerability, the issues will be classified.

• Apex Serious Security Risk
• Apex Critical Security Risk
• JavaScript High Risk
• JavaScript Low Visibility
• Apex Code Quality

Following are some of the common AppExchange Solution security threats based on the group type:

• Client DOM (Document Object Model) Stored XSS: JavaScript High Risk
• Multiple forms in Visualforce page
• URL Redirection Attack: Apex Serious Security Risk
• SOQL and SOSL Injection: Apex Critical Security Risk
• DML Statements Inside Loops: Apex Code Quality

Let us discuss these issues along with a solution.

Examples:

1. XSS client DOM stored XSS

DOM-based XSS vulnerabilities mostly occur when JavaScript takes data from an attacker-controllable source. Here, we have added an escape attribute equal to false. Be aware that putting this value to “false” may be a security risk because it allows DOM content, including JavaScript, which could be used in a malicious manner.

<apex:outputText escape=“false” value=“{!Terms_and_conditions__c}”/> 

Solution:

<p>{!Terms_and_Conditions__c}</p>

OR

<apex:outputText value="{!Terms_and_Conditions__c}" />

2. Multiple forms Issue

• Sample snippet form Visualforce page.

  <apex:outputPanel>
  <apex:form><apex:commandButton value="Custom Action One" action="{!customAction1}"/>
  </apex:form>
  </apex:outputPanel>
  <apex:form >
  <apex:inputText value="{!customText1}"/><br/>
  <apex:commandButton value="Custom Action Two" action="{!updateCustomText1}"/>
  </apex:form> 
  

• If you are using multiple forms on the same Visualforce page, we will get “Multiple forms in the same page” issue.

Solution:

• We should have only one form per Visualforce page. Then, add all elements inside that form tag.

3. URL redirection attack

• Do not hard code any URL for redirection. The following format is not a good practice.

  String url = hostURL+'/'+salesforce.com/forums/?id=recordId; 
  

• If you are returning this string variable for iframe or some other redirection purpose, we will get a URL redirection attack issue.

Solution

• Use page reference class for URL redirection; also you can use EncodingUtil class methods.

  String url = hostURL+'/'+salesforce.com/forums/?id= EncodingUtil.urlEncode(recordId, 'UTF8'); 
  PageReference redirect = new PageReference(url);
  

• Visualforce page with iframe redirection to another page.

4. SOQL AND SOSL Injection

• Below is a simple example of Apex and Visualforce code vulnerable to SOQL injection.
  VF Page:

  <apex:page controller="SOQLApexController" >
  <apex: form>
  <apex:outputText value="Enter Your Name" />
  <apex:inputText value="{!name}" />
  <apex:commandButton value="Query" action="{!query}" />
  </apex: form>
  </apex: page>
  

  Apex Class (Controller):

  public class SOQLApexController
  { 
  	public String name 
  	{ 
  		get { return name;} 
  		set { name = value;} 
  	}  
  	public PageReference query() 
            { 
      		String qryString = ‘SELECT Id FROM Contact WHERE ‘ + 
          		‘(IsDeleted = false and Name like \’%’ + name + ‘%\’)’; 
  	    	List queryResult = Database.query(qryString); 
      		System.debug(‘query result is ‘ + queryResult); 
  	    	return null; 
  	} 
  } 
  

Solution:

• To avoid SOQL injection attacks, do not use dynamic SOQL queries. Instead, use static queries and binding variables for user input and concatenation. The above vulnerable example can be rewritten using the static SOQL as follows:
  Apex Class(Controller):

  public class SOQLApexController 
  {  
  	public String name 
  	{  
  	   get { return name;}  
  	   set { name = value;}  
  	}  
  	public PageReference query() 
  	{  
      		String queryName = ‘%’ + name + ‘%’; 
  	    	List queryResult = [SELECT Id FROM Contact WHERE  
         	(IsDeleted = false and Name like :queryName)]; 
  	    	System.debug(‘query result is ‘ + queryResult); 
  	    	return null;  
  	}  
  }
  

5. DML Statement inside the for loop

• In your Apex controller or trigger,do not place SOQL or DML statements inside a loop. If you did, database operations will trigger once per iteration of the loop. It will be a reason to reach the SFDC governor limits.

  for (Account con : Trigger.New) 
  { 
  	Contact con = new Contact (LastName = ‘Test’); 
   	Insert con;
  }
  

Solution:

• Move all the DML statements outside the loop. If you need to get any data inside the loop to perform DML operations, then use Collections.

  list conList = new List (); 
  for (Account acc: Trigger.New) 
  { 
  	conList.add(new Contact (FirstName='Info', 
  	LastName='Default', 
  	Email= 'info@websitedomain.tld', 
  	AccountId= acc.Id)); 
  } 
  if(conList.size()>0) 
  { 
  	insert conList; 
  }
  

• Here is some more information about the most critical web application security risks and solutions for the same. You can view them at Open Web Application Security Project (OWASP) Top Ten awareness document. (OWASP is a nonprofit foundation that works to improve the security of software)