Clayton

JavaScript of any type is not allowed to run within the Salesforce.com application context. This includes JavaScript blocks within HomePageComponents, WebLinks, Custom buttons, and all other components run under the Salesforce DOM.

<a href="https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_security_tips_xss.htm" rel="nofollow noopener noreferrer" target="_blank">Cross-Site Scripting (XSS)</a>

<a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html" rel="nofollow noopener noreferrer" target="_blank">Cross Site Scripting Prevention Cheat Sheet</a>

<a href="https://developer.salesforce.com/docs/atlas.en-us.secure_coding_guide.meta/secure_coding_guide/secure_coding_cross_site_scripting.htm" rel="nofollow noopener noreferrer" target="_blank">Secure Coding Cross Site Scripting</a>

<a href="https://trailhead.salesforce.com/en/content/learn/modules/secure-clientside-development/mitigate-crosssite-scripting" rel="nofollow noopener noreferrer" target="_blank">Mitigate Cross-Site Scripting</a>

<a href="https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_weblink.htm" rel="nofollow noopener noreferrer" target="_blank">WebLink</a>

- <a href="https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_security_tips_xss.htm" rel="nofollow noopener noreferrer" target="_blank">Cross-Site Scripting (XSS)</a>
- <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html" rel="nofollow noopener noreferrer" target="_blank">Cross Site Scripting Prevention Cheat Sheet</a>
- <a href="https://developer.salesforce.com/docs/atlas.en-us.secure_coding_guide.meta/secure_coding_guide/secure_coding_cross_site_scripting.htm" rel="nofollow noopener noreferrer" target="_blank">Secure Coding Cross Site Scripting</a>
- <a href="https://trailhead.salesforce.com/en/content/learn/modules/secure-clientside-development/mitigate-crosssite-scripting" rel="nofollow noopener noreferrer" target="_blank">Mitigate Cross-Site Scripting</a>
- <a href="https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_weblink.htm" rel="nofollow noopener noreferrer" target="_blank">WebLink</a>
   

Rationale

Scope

Related resources