[vf] Html encoding of controller fields is insufficient to prevent XSS

[rmohan20]

Affects PMD Version:
6.27.0+
7.0.0

Rule:
VfUnescapeElRule

Description:

Html encoding inside javascript event handler methods does not prevent XSS. This stackoverflow answer explains the situation well.
To avoid giving a false sense of safety, VfUnescapeElRule should throw a rule violation when it detects a javascript event handler applying html encoding on a controller value.

Code Sample demonstrating the issue:

<img src="{!Name}" onerror="console.log('couldn't load {!HTMLENCODE(Name)}')"/>

Expected outcome:
Rule violation. Current behavior is a false-negative.

Running PMD through: CLI

[adangel]

See also https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_scontrols.htm