A-2300 Never use the HTML (Unsafe) format on Display-Only items.
Reason
The deprecated HTML (Unsafe) format renders the item's value as-is, including <script> tags, javascript: URLs and event handlers such as onclick. If the value contains anything users can enter or edit, this allows stored cross-site scripting (XSS). Since APEX 23.1, the HTML format strips this active content and still renders normal formatting. When an app was upgraded to 23.1, APEX switched existing HTML items to HTML (Unsafe), so older apps often use it without anyone having chosen it.
Switch the item's format to HTML (or Plain Text) under Settings › Format. If the value relies on inline scripts or onclick handlers, move that logic to a dynamic action.
Example
Non-Compliant Example
page 10 (
// ...
pageItem P10_DESCRIPTION (
type: displayOnly
settings {
format: htmlUnsafe
}
// ...
)
) | Line | Column | Message |
|---|---|---|
| 6 | 21 | Display Only item uses the unsafe HTML format. |
Compliant Solution - ★★★★★
page 10 (
// ...
pageItem P10_DESCRIPTION (
type: displayOnly
settings {
format: html
}
// ...
)
) Tests
Test SQL query
select aa.workspace || '.' || aa.alias || '.' || pi.item_name as identifier,
'Display-Only item ' || pi.item_name || ' of app ' || aa.alias || ' in ' || aa.workspace
|| ' uses the unsafe HTML format.' as message
from apex_application_page_items pi
join apex_applications aa
on aa.application_id = pi.application_id
and aa.workspace = pi.workspace
where pi.display_as_code = 'NATIVE_DISPLAY_ONLY'
and json_value(pi.attributes, '$.format') = 'HTML_UNSAFE'
and aa.workspace in (#ApexWorkspaces#)Test results
| Identifier | Message | Migration |
|---|---|---|
| WORKSPACE.CUSTOMERS.P10_DESCRIPTION | Display-Only item P10_DESCRIPTION of app CUSTOMERS in WORKSPACE uses the unsafe HTML format. | - |
Parameters
Use parameters to customize the rule to your needs.
| Parameter | Description | Default Value |
|---|---|---|
| ApexWorkspaces | Comma-separated List of APEX workspaces owning APEX applications to check. | dblinter, dbl_gui |
References
- same as UC-2300
- related to OWASP A05:2025 Injection