Impact area
Security
Severity
High
Affected element
ServiceNow
UI Script
Salesforce
Static Resource
Rule number #
SN-JSL-HANDLEBARS-LESSTHAN-V400 (for ServiceNow)
SF-JSL-HANDLEBARS-LESSTHAN-V400 (for Salesforce)
Impact #
When using attributes without quotes in a handlebars template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability, assuming an attacker can influence the value entered into the template. If the handlebars template is used to render user-generated content, this vulnerability may escalate to a persistent XSS vulnerability.
Remediation
Update the Handlebars JS library to the latest version.
Time to fix #
30 min
References #
This rule is linked to Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’).
