diff --git a/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java b/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java index 8ad7a53a58..7ee825866c 100644 --- a/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java +++ b/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java @@ -85,22 +85,24 @@ public class VfUnescapeElRule extends AbstractVfRule { } if (quoted) { // check escaping too - if (!(startsWithSafeResource(elExpression) || containsSafeFields(elExpression))) { + if (!(jsonParse || startsWithSafeResource(elExpression) || containsSafeFields(elExpression))) { if (doesElContainAnyUnescapedIdentifiers(elExpression, EnumSet.of(Escaping.JSENCODE, Escaping.JSINHTMLENCODE))) { addViolation(data, elExpression); } } } else { - if (!(jsonParse || startsWithSafeResource(elExpression) || containsSafeFields(elExpression))) { + if (!(startsWithSafeResource(elExpression) || containsSafeFields(elExpression))) { addViolation(data, elExpression); } } } private boolean isJsonParse(ASTText prevText) { - if (prevText.getImage().endsWith("JSON.parse(") || prevText.getImage().endsWith("jQuery.parseJSON(") - || prevText.getImage().endsWith("$.parseJSON(")) { + final String text = (prevText.getImage().endsWith("'") || prevText.getImage().endsWith("'")) + ? prevText.getImage().substring(0, prevText.getImage().length() - 1) : prevText.getImage(); + + if (text.endsWith("JSON.parse(") || text.endsWith("jQuery.parseJSON(") || text.endsWith("$.parseJSON(")) { return true; } diff --git a/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml b/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml index b0757b5234..915d45ad51 100644 --- a/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml +++ b/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml @@ -575,15 +575,30 @@ NOT method evaluates to safe boolean 0 + + +]]> + vf + + + + + 1 + ]]>