Hi Guys,

Please I need some help regarding the force.com secutiry review.

We have an application which we sent for security review.... the application is completly based on force.com and do not have

any other integration...

We did run the chexmax report and it did not receive any Vulnerability messages and was clean..

now we have recived the feedback and have 3 major problems could you please help me with the same

below are the 3 problem, how can i overcome them..

1. DOM based XSS Vulnerability

Code

           if (desc.length > 0){
                tdesc = "<span class='desc'>" + unescape(desc) + "</span>"; 
           }
           if (cmt.length > 0){
                tcmt = "<span class='h'>Comment</span><span class='cmt'>" + unescape(cmt) + "</span>"; 
           }
           title = tdesc + tcmt;
           return title;

File

Winscope_MVPs.page

Notes

Data from custom object is written into the DOM and then placed, via js, into an html execution context. 

How can overcome the above problem in the page.

2. FLS Create Vulnerability

Code

Line 77:         edit = true;
Line 78:         
Line 79:         ap = new Action_Plan__c(Opportunity__c=oppId, From__c=fromModule, Who__c=UserInfo.getUserId(),Related_Record_ID__c=recId);
Line 80:         if (recId==null) ap.Winscope_Page__c = WinscopePage; //Action added from respective module page
Line 81:     }//End of WS_AddActionCon
Line 82: 
Line 83:     public void saveAction() {

What can be done to pass the review in above case....

3. URL Redirection Attack Vulnerability

Code

Line 133:     }
Line 134:     
Line 135:     public pageReference backToAction(){
Line 136:         String PageName = apexPages.currentPage().getParameters().get('pageName');    
Line 137:         PageReference pg = new pageReference(PageName);
Line 138:         pg.setRedirect(true);
Line 139:         return pg;

Please guys I am looking into it but if you could please let me know what is the Vulnerability and how it can be fixed.

Awaiting your reply guys thanks.