[apex] False positive for ApexXSSFromURLParam

[ankushsomani09]

Affects PMD Version:
6.24+
7.0.0

Rule: ApexXSSFromURLParam

Rule name
https://pmd.github.io/pmd-6.24.0/pmd_rules_apex_security.html#apexxssfromurlparam

Description: False positive, even String.escapeSingleQUotes is being used on url parameter input
Apex method link to prevent XSS : https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_methods_system_string.htm#apex_System_String_escapeSingleQuotes
Code Sample demonstrating the issue:

String IdAccount = String.escapeSingleQuotes(Apexpages.currentPage().getParameters().get('Id'));  
-------------OR-----
String IdAccount = Apexpages.currentPage().getParameters().get('Id');  
IdAccount = String.escapeSingleQuotes(IdAccount); // Here on this lines gives exception

Expected outcome:

• Does PMD report a violation, where there shouldn't be one? -> false-positive

Running PMD through: [Ant]

[dschach]

String IdAccount = String.escapeSingleQuotes(Apexpages.currentPage().getParameters().get('Id')); <-- I have an error on this line. Running ApexPMD in VSCode (0.5.8, so PMD 6.41)

[nwcm]

This rule should likely be deprecated.

Apexpages.currentPage().getParameters() returns a Map<String, String>

So requiring casting to (String) passes this rule, even though the return of getParameters().get('foo') is a String