FAQ-001497 - Platform Component Security Differences / Common Security Pitfalls

Current Status:VALID_RESPONSEErrorUnable to AnswerSuggests Case

Current FAQ

Question
What are the common security pitfalls when working with both Visualforce pages and Lightning components?
Answer
Here are some common security pitfalls to watch out for when working with Visualforce pages and Lightning components: 1. **Loading Third-Party Resources**: Dynamically loading JavaScript or CSS from third-party endpoints is risky. Use static resources within your package instead. 2. **Cross-Site Scripting (XSS)**: In Visualforce, merge fields are auto-encoded unless `escape="false"` is used. In Lightning components, no auto-encoding occurs, so you must sanitize user-controlled data before rendering it. 3. **Open Redirects**: Improper handling of redirection parameters in Visualforce can lead to open redirect vulnerabilities. Hardcoding redirect values is a safer approach. 4. **Sandbox Violations**: Avoid attempts to break out of the sandbox or run code outside the designated origin, as this violates secure coding practices. 5. **Dynamic Content**: Dynamically loading HTML, JavaScript, or CSS into UI components is not allowed unless the content is stripped of executable code. 6. **Sensitive Data Exposure**: Never log sensitive data (e.g., passwords, API keys) in debug statements or pass them in URLs. Always encrypt or omit such data. 7. **Improper Use of Attributes**: In Lightning components, binding user-controlled data to unsafe attributes like `href` or `src` without sanitization can lead to vulnerabilities. Use secure filters or sanitize data in the controller. 8. **LockerService and Component Isolation**: Adhere to LockerService requirements in Lightning components to ensure proper isolation and prevent code privilege issues. By addressing these pitfalls, you can significantly improve the security of your Visualforce pages and Lightning components.
Enhancing FAQ...

Enhancing FAQ with AI recommendations...

AI Recommended Enhancement

Related Security Rules (click to view)
ApexXSSFromEscapeFalseVfUnescapeElApexOpenRedirectAvoidUnescapedHtmlInAuraAvoidHardCodedCredentialsInAuraProtectSensitiveDataAvoidCreateElementScriptLinkTagLoadJavaScriptIncludeScriptLoadCSSLinkHrefAvoidAuraWithLockerDisabled
Question
What are the common security pitfalls when working with both Visualforce pages and Lightning components?
Recommended Answer Update
Here are common security pitfalls to watch out for when working with Visualforce pages and Lightning components: 1. **Loading Third-Party Resources**: Dynamically loading JavaScript or CSS from third-party endpoints is risky. Use static resources within your package instead. 2. **Cross-Site Scripting (XSS)**: In Visualforce, merge fields are auto-encoded unless `escape="false"` is used. In Lightning components, no auto-encoding occurs, so you must sanitize user-controlled data before rendering it. 3. **Open Redirects**: Improper handling of redirection parameters in Visualforce can lead to open redirect vulnerabilities. Hardcoding redirect values is a safer approach. 4. **Sandbox Violations**: Avoid attempts to break out of the sandbox or run code outside the designated origin, as this violates secure coding practices. 5. **Dynamic Content**: Dynamically loading HTML, JavaScript, or CSS into UI components isn't allowed unless the content is stripped of executable code. 6. **Sensitive Data Exposure**: Never log sensitive data (e.g., passwords, API keys) in debug statements or pass them in URLs. Always encrypt or omit such data. 7. **Improper Use of Attributes**: In Lightning components, binding user-controlled data to unsafe attributes like `href` or `src` without sanitization can lead to vulnerabilities. Use secure filters or sanitize data in the controller. 8. **LockerService and Component Isolation**: Adhere to LockerService requirements in Lightning components to ensure proper isolation and prevent code privilege issues. By addressing these pitfalls, you can significantly improve the security of your Visualforce pages and Lightning components.
Reasoning
The answer is comprehensive and accurate but needed minor phrasing improvements for clarity. Changed 'is not allowed' to 'isn't allowed' for more conversational tone per style guidelines. All technical content aligns with the security rules and remains current. Selected security rules relate directly to the FAQ content: - ApexXSSFromEscapeFalse: FAQ discusses Visualforce XSS issues with escape="false" - VfUnescapeEl: FAQ covers Visualforce merge field encoding vulnerabilities - ApexOpenRedirect: FAQ explicitly mentions open redirect vulnerabilities in Visualforce - AvoidUnescapedHtmlInAura: FAQ discusses lack of auto-encoding in Lightning components requiring sanitization - AvoidHardCodedCredentialsInAura: FAQ mentions sensitive data exposure including API keys in Lightning components - ProtectSensitiveData: FAQ covers protecting sensitive data like passwords and API keys from logging - AvoidCreateElementScriptLinkTag: FAQ discusses dynamically loading JavaScript/CSS being risky - LoadJavaScriptIncludeScript: FAQ mentions loading third-party JavaScript as a security risk - LoadCSSLinkHref: FAQ covers loading third-party CSS as problematic - AvoidAuraWithLockerDisabled: FAQ discusses LockerService requirements for component isolation
Reasoning References