A-1100 Try to keep hidden page items protected.
Reason
A hidden page item still travels to the browser and back on page submit. With Value Protected enabled, APEX adds a checksum for the rendered value and rejects the submit if it was changed, so a malicious user cannot alter a hidden item (for example a primary key or a price) by editing the form post. Keep Value Protected set to Yes (the default) whenever possible.
The catch: the checksum only covers the value APEX rendered. As soon as JavaScript sets the item e.g. a dynamic action or apex.item().setValue(), the checksum no longer matches and the submit fails. That is why developers switch protection off. But then APEX accepts any value for that item, because a legitimate JavaScript change and a tampered request look identical to the server.
Before turning protection off, prefer one of these:
- Only the browser needs the value: change the item type to Display Only and set Send on Page Submit to
Off. JavaScript can still read and write it, but the value is never processed on the server. But it is not hidden anymore. - The value must reach the server: treat it exactly like user input. Re-validate it on the server (authorization, ownership, allowed range) instead of trusting it, or derive it on the server from data the user cannot influence. If it must round-trip unchanged, generate your own server-side checksum for it (e.g. via
apex_util.get_hash) and verify it on submit.
Example
Non-Compliant Example
page 10 (
// ...
pageItem P10_PRICE (
type: hidden
settings {
valueProtected: false
}
// ...
)
) | Line | Column | Message |
|---|---|---|
| 6 | 29 | Hidden item does not have Value Protected enabled. |
Compliant Solution - ★★★★★
page 10 (
// ...
pageItem P10_PRICE (
type: hidden
// ...
)
) Tests
Test SQL query
select aa.workspace || '.' || aa.alias || '.' || pi.item_name as identifier,
'Hidden item ' || pi.item_name || ' of app ' || aa.alias || ' in ' || aa.workspace
|| ' does not have Value Protected enabled.' as message
from apex_application_page_items pi
join apex_applications aa
on aa.application_id = pi.application_id
and aa.workspace = pi.workspace
where pi.display_as_code = 'NATIVE_HIDDEN'
and json_value(pi.attributes, '$.value_protected') = 'N'
and aa.workspace in (#ApexWorkspaces#)Test results
| Identifier | Message | Migration |
|---|---|---|
| WORKSPACE.CUSTOMERS.P10_PRICE | Hidden item P10_PRICE of app CUSTOMERS in WORKSPACE does not have Value Protected enabled. | - |
Parameters
Use parameters to customize the rule to your needs.
| Parameter | Description | Default Value |
|---|---|---|
| ApexWorkspaces | Comma-separated List of APEX workspaces owning APEX applications to check. | dblinter, dbl_gui |
References
- related to OWASP A01:2021 – Broken Access Control
- same as UC-1100