MENU
A developer is checking for Cross Site Scripting (XSS) and found that the quick search is not escaped (allows inclusion of Javascript) in the following script:
How would the developer resolve this issue?
Suggested Answer: B
Get Premium Salesforce Certified B2C Commerce Architect (Arch-303) Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
To resolve the issue of Cross Site Scripting (XSS) where the quick search is not escaped, the developer should use the <isprint> tag with the 'jshtml' encoding option (Answer B). This method ensures that any JavaScript included in the search phrase is properly escaped, preventing the execution of potentially malicious scripts. The 'jshtml' encoding is specifically designed to encode text for HTML contexts where JavaScript is embedded, providing a secure way to handle user input in Salesforce B2C Commerce.
31 comments · newest first
EL
Elise
23 days ago
Definitely B! We need to prevent XSS attacks.
RO
Rossana
28 days ago
Option C could work too, but B feels safer.
SA
Sang
1 month ago
I agree, B makes sense. Security is key!
GI
Giovanna
1 month ago
I think option B is the best choice. It properly encodes for JavaScript.
SH
Shawna
1 month ago
I feel like D is too risky. We can't just print without escaping!
LA
Lawrence
2 months ago
Option C seems good too, but I prefer B for clarity.
RH
Rhea
2 months ago
I think option B is the best. It properly encodes for JavaScript.
NI
Niesha
2 months ago
This XSS issue is serious. We need to escape inputs.
VI
Vicki
2 months ago
I feel like A is too risky. Double quotes can lead to issues.
MA
Matilda
2 months ago
Option C could work too, but B is more straightforward.
PH
Phil
2 months ago
I agree, B seems secure. We need to prevent XSS.
SH
Shoshana
3 months ago
I think option B is the best choice. It properly encodes for JavaScript.
ON
Onita
3 months ago
Double quotes won't fix the escaping issue, so A is not the way to go.
DE
Denny
3 months ago
Just using toprint won't be enough, we need proper encoding.
PA
Patria
3 months ago
Surprised that this issue wasn't caught earlier!
VA
Van
3 months ago
I disagree, I think option C is better for handling special characters.
MA
Marla
4 months ago
Option B seems like the safest choice for XSS prevention.
MA
Marsha
4 months ago
Double quotes in A? That doesn't sound right for escaping.
RA
Ranee
4 months ago
D is just printing it out, that won't help with XSS!
LE
Lemuel
5 months ago
Wait, are we really trusting user input at all?
JA
Jade
6 months ago
I think C is better, it looks more secure to me.
LA
Lawrence
6 months ago
Option B seems like the safest choice for XSS prevention.
NO
Noah
6 months ago
C looks good, but I wonder if it covers all cases.
ME
Melvin
6 months ago
I disagree, A won't fix the escaping issue properly.
RO
Rolland
6 months ago
Wait, are we really allowing JavaScript in the search? That's risky!
AM
Amie
6 months ago
I think D is a solid option too, but not sure if it's the best.
GL
Glory
7 months ago
Option B seems like the best choice for XSS protection.
CH
Chaya
7 months ago
I recall that using is generally a good practice for escaping, but I can't remember if it's the right choice here.
WY
Wynell
7 months ago
I'm a bit confused about the difference between 'jshtmr' and 'jsblock'—I feel like I need to review those examples again.
NI
Nieves
7 months ago
I think option C sounds familiar; it might be the one we practiced that uses 'jsblock' encoding.
VA
Vallie
7 months ago
I remember we discussed XSS prevention techniques, but I'm not entirely sure which encoding method is the best for this case.