Merge branch 'pr-2638'

[visualforce] add new safe resource for VfUnescapeEl #2638

docs/pages/release_notes.md

@@ -25,6 +25,8 @@ This is a {{ site.pmd.release_type }} release.
     *   [#2610](https://github.com/pmd/pmd/pull/2610): \[apex] Support top-level enums in rules
 *   apex-bestpractices
     *   [#2626](https://github.com/pmd/pmd/issues/2626): \[apex] UnusedLocalVariable - false positive on case insensitivity allowed in Apex
+*   apex-security
+    *   [#2620](https://github.com/pmd/pmd/issues/2620): \[visualforce] False positive on VfUnescapeEl with new Message Channel feature
 *   core
     *   [#710](https://github.com/pmd/pmd/issues/710): \[core] Review used dependencies
     *   [#2594](https://github.com/pmd/pmd/issues/2594): \[core] Update exec-maven-plugin and align it in all project
@@ -52,6 +54,7 @@ This is a {{ site.pmd.release_type }} release.
 *   [#2560](https://github.com/pmd/pmd/pull/2560): \[java] Fix false positives of LawOfDemeter: this and cast expressions - [xioayuge](https://github.com/xioayuge)
 *   [#2590](https://github.com/pmd/pmd/pull/2590): Update libraries snyk is referring to as `unsafe` - [Artem Krosheninnikov](https://github.com/KroArtem)
 *   [#2597](https://github.com/pmd/pmd/pull/2597): \[dependencies] Fix issue #2594, update exec-maven-plugin everywhere - [Artem Krosheninnikov](https://github.com/KroArtem)
+*   [#2621](https://github.com/pmd/pmd/pull/2621): \[visualforce] add new safe resource for VfUnescapeEl - [Peter Chittum](https://github.com/pchittum)
 
 {% endtocmaker %}
 

pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java

@@ -296,6 +296,7 @@ public class VfUnescapeElRule extends AbstractVfRule {
                     case "$objecttype":
                     case "$component":
                     case "$remoteaction":
+                    case "$messagechannel":
                         return true;
 
                     default:

pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml

@@ -537,4 +537,17 @@
 <a onclick="openTab({!HTMLENCODE('/apex/Download?redirectUrl=' + downloadURL)}', 'test');">
         ]]></code>
     </test-code>
+
+    <test-code>
+        <description>Support new message channel feature #2620</description>
+        <expected-problems>0</expected-problems>
+        <code><![CDATA[
+<script type="text/javascript">
+    // Binding message channel to variable accessible to static resource.
+    window.util = {
+        messageChannel: '{!$MessageChannel.Record_Selected__c}'
+    };
+</script>
+        ]]></code>
+    </test-code>
 </test-data>