---
title: Security
summary: Rules that flag potential security flaws.
permalink: pmd_rules_vf_security.html
folder: pmd/rules/vf
sidebaractiveurl: /pmd_rules_vf.html
editmepath: ../pmd-visualforce/src/main/resources/category/vf/security.xml
keywords: Security, VfCsrf, VfUnescapeEl
language: Salesforce VisualForce
---
## VfCsrf

**Since:** PMD 5.6.0

**Priority:** Medium (3)

Avoid calling VF action upon page load as the action becomes vulnerable to CSRF.

**This rule is defined by the following Java class:** [net.sourceforge.pmd.lang.vf.rule.security.VfCsrfRule](https://github.com/pmd/pmd/blob/master/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfCsrfRule.java)

**Example(s):**

``` vf
<apex:page controller="AcRestActionsController" action="{!csrfInitMethod}" >
```

**Use this rule by referencing it:**
``` xml
<rule ref="category/vf/security.xml/VfCsrf" />
```

## VfUnescapeEl

**Since:** PMD 5.6.0

**Priority:** Medium (3)

Avoid unescaped user controlled content in EL as it results in XSS.

**This rule is defined by the following Java class:** [net.sourceforge.pmd.lang.vf.rule.security.VfUnescapeElRule](https://github.com/pmd/pmd/blob/master/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java)

**Example(s):**

``` vf
<apex:outputText value="Potential XSS is {! here }" escape="false" />
```

**Use this rule by referencing it:**
``` xml
<rule ref="category/vf/security.xml/VfUnescapeEl" />
```

