AGENTFORCE-VF-01: Visualforce XSS via escape=false

🚨 Critical · XSS

Detects Visualforce components with escape="false", which disables auto-escaping and enables XSS.

Details

Field	Value
Rule ID	AGENTFORCE-VF-01
Severity	Critical
Category	XSS

Remediation

Remove escape="false" or ensure the value is strictly sanitized server-side. Prefer apex:outputText with default escaping.

See Also

• Rule catalog index
• Scanning basics
• SARIF output