diff --git a/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java b/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java index 6228ba40b9..9687b54175 100644 --- a/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java +++ b/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java @@ -250,16 +250,51 @@ public class VfUnescapeElRule extends AbstractVfRule { List args = expression.findChildrenOfType(ASTArguments.class); if (!args.isEmpty()) { switch (id.getImage().toLowerCase()) { - case "$component": - case "$objecttype": - case "$label": - case "$resource": case "urlfor": - case "$site": - case "$page": - case "$action": case "casesafeid": + case "begins": + case "contains": + case "len": case "not": + case "getrecordids": + case "linkto": + case "sqrt": + case "round": + case "mod": + case "log": + case "ln": + case "exp": + case "abs": + case "floor": + case "ceiling": + case "nullvalue": + case "isnumber": + case "isnull": + case "isnew": + case "isblank": + case "isclone": + case "year": + case "month": + case "day": + case "datetimevalue": + case "datevalue": + case "date": + case "now": + case "today": + return true; + + default: + } + } else { + // has no arguments + switch (id.getImage().toLowerCase()) { + case "$action": + case "$page": + case "$site": + case "$resource": + case "$label": + case "$objecttype": + case "$component": case "$remoteaction": return true; diff --git a/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml b/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml index 3182902eb4..4637e4de4d 100644 --- a/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml +++ b/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml @@ -620,5 +620,35 @@ JSON.parse method evaluates escaped EL to safe JSON vf + + + 0 + + + +]]> + vf + + + + + 0 + + + +]]> + vf + +