A-3080 Avoid making Interactive Grid columns read-only with CSS only.
Reason
The CSS class is-readonly only stops editing in the browser. The value is still part of the grid's submit, and the DML process writes whatever arrives, so a user can change it with the browser's developer tools or a crafted request.
Enforce read-only on the server: set the column to Query Only (Source > Query Only) if it is never written, or add a Read Only condition. If JavaScript has to set the value and it must be saved, keep the column editable and validate the value on the server.
Example
Non-Compliant Example
page 10 (
// ...
region orders (
name: Orders
// ...
advanced {
htmlDomId: orders
}
column TOTAL (
type: numberField
// ...
source {
databaseColumn: TOTAL
dataType: number
}
appearance {
cssClasses: is-readonly
}
)
)
) | Line | Column | Message |
|---|---|---|
| 18 | 29 | Column is read-only by CSS only; the server still accepts a submitted value. |
Compliant Solution - ★★★★★
page 10 (
// ...
region orders (
name: Orders
// ...
advanced {
htmlDomId: orders
}
column TOTAL (
type: numberField
// ...
source {
databaseColumn: TOTAL
dataType: number
queryOnly: true
}
appearance {
cssClasses: is-readonly
}
)
)
) Tests
Test SQL query
select aa.workspace || '.' || aa.alias || '.' || c.page_id || '.' || coalesce(r.static_id, to_char(r.region_id)) || '.' || c.name as identifier,
'Column ' || c.name || ' of Interactive Grid ' || c.region_name || ' on page ' || c.page_id || ' of app ' || aa.alias
|| ' in ' || aa.workspace || ' is read-only by its is-readonly CSS class only, so the server still accepts a submitted value.' as message
from apex_appl_page_ig_columns c
join apex_application_page_regions r
on r.application_id = c.application_id
and r.region_id = c.region_id
join apex_applications aa
on aa.application_id = c.application_id
and aa.workspace = c.workspace
where aa.workspace in (#ApexWorkspaces#)
and ' ' || c.value_css_classes || ' ' like '% is-readonly %'
and c.is_query_only = 'No'
and c.read_only_condition_type_code is null
and exists (select 1
from apex_appl_page_igs ig
where ig.application_id = c.application_id
and ig.region_id = c.region_id
and ig.is_editable = 'Yes')Test results
| Identifier | Message | Migration |
|---|---|---|
| WORKSPACE.CUSTOMERS.10.orders.TOTAL | Column TOTAL of Interactive Grid Orders on page 10 of app CUSTOMERS in WORKSPACE is read-only by its is-readonly CSS class only, so the server still accepts a submitted value. | - |
Parameters
Use parameters to customize the rule to your needs.
| Parameter | Description | Default Value |
|---|---|---|
| ApexWorkspaces | Comma-separated List of APEX workspaces owning APEX applications to check. | dblinter, dbl_gui |
References
- same as UC-3080
- similar to OWASP A04:2021 – Insecure Design