diff --git a/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java b/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java
index 8ad7a53a58..7ee825866c 100644
--- a/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java
+++ b/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java
@@ -85,22 +85,24 @@ public class VfUnescapeElRule extends AbstractVfRule {
}
if (quoted) {
// check escaping too
- if (!(startsWithSafeResource(elExpression) || containsSafeFields(elExpression))) {
+ if (!(jsonParse || startsWithSafeResource(elExpression) || containsSafeFields(elExpression))) {
if (doesElContainAnyUnescapedIdentifiers(elExpression,
EnumSet.of(Escaping.JSENCODE, Escaping.JSINHTMLENCODE))) {
addViolation(data, elExpression);
}
}
} else {
- if (!(jsonParse || startsWithSafeResource(elExpression) || containsSafeFields(elExpression))) {
+ if (!(startsWithSafeResource(elExpression) || containsSafeFields(elExpression))) {
addViolation(data, elExpression);
}
}
}
private boolean isJsonParse(ASTText prevText) {
- if (prevText.getImage().endsWith("JSON.parse(") || prevText.getImage().endsWith("jQuery.parseJSON(")
- || prevText.getImage().endsWith("$.parseJSON(")) {
+ final String text = (prevText.getImage().endsWith("'") || prevText.getImage().endsWith("'"))
+ ? prevText.getImage().substring(0, prevText.getImage().length() - 1) : prevText.getImage();
+
+ if (text.endsWith("JSON.parse(") || text.endsWith("jQuery.parseJSON(") || text.endsWith("$.parseJSON(")) {
return true;
}
diff --git a/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml b/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml
index b0757b5234..915d45ad51 100644
--- a/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml
+++ b/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml
@@ -575,15 +575,30 @@ NOT method evaluates to safe boolean
0
+
+
+]]>
+ vf
+
+
+
+
+ 1
+
]]>