Prepare for a new Security Review

[VinceFINET]

Ticket to fix issues highlighted by the Checkmarx code scan. So that we have all green flag to submit agan for the security review.

[VinceFINET]

October 17, 2025

Vulnerability Type	Occurrences	Severity
Client DOM XSS	1	High
Client Potential XSS	8	Medium

Files to correct:

• /forceapp/main/default/lwc/orgcheckApp/orgcheckApp.js
• /forceapp/main/default/lwc/orgcheckApp/orgcheckApp.html

Client DOM XSS

This untrusted data is embedded into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the generated web-page

Path 1:

	Source	Destination
File	orgcheckApp.js	orgcheckApp.html
Line	792	54
Object	value	selectedMainTab

Client Potential XSS

This untrusted data is embedded into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the generated web-page.

Path 1:

	Source	Destination
File	orgcheckApp.js	orgcheckApp.html
Line	792	54
Object	value	selectedMainTab

Path 2:

	Source	Destination
File	orgcheckApp.js	orgcheckApp.html
Line	804	56
Object	value	selectedSubTab

Path 3:

	Source	Destination
File	orgcheckApp.js	orgcheckApp.html
Line	804	491
Object	value	selectedSubTab

Path 4:

	Source	Destination
File	orgcheckApp.js	orgcheckApp.html
Line	804	560
Object	value	selectedSubTab

Path 5:

	Source	Destination
File	orgcheckApp.js	orgcheckApp.html
Line	804	594
Object	value	selectedSubTab

Path 6:

	Source	Destination
File	orgcheckApp.js	orgcheckApp.html
Line	804	620
Object	value	selectedSubTab

Path 7:

	Source	Destination
File	orgcheckApp.js	orgcheckApp.html
Line	804	654
Object	value	selectedSubTab

Path 8:

	Source	Destination
File	orgcheckApp.js	orgcheckApp.html
Line	804	704
Object	value	selectedSubTab

[VinceFINET]

The fix has the following results:

[VinceFINET]

The two remaining issues were located at the same location in the code:

The reason is the value of the tab could be anything and the code was not checking the type etc.
Previous commit (1814ead) should correct this.