title: Reflected XSS and Stored XSS in checmarx
body: <p>I am having 2 pages </p>
  
  <ol>
  <li>parent page consist a link, on click of this link i am calling an javascript function </li>
  </ol>
  
  <hr>
  
  <pre><code>function callPage( productId ){
     var product = document.getElementById(ProductId).id;
     var OpptyId = {!oppty.Id};
     var urlToOpen = "/apex/" + '{!namespacePrefix}' + 'testPage?product='+product+'&amp;OpptyId'=OpptyId ;
  
     window.open(urlToOpen ,'','resizable=0,location=0,status=0,scrollbars=0,width=850,height=350,top=100,left=220')
  }
  </code></pre>
  
  <p>where Oppty Id is taken from controller.</p>
  
  <ol start="2">
  <li>While in my child page I am getting all these paramiters as</li>
  </ol>
  
  <hr>
  
  <pre><code>ProductValueId = ApexPages.currentPage().getParameters().get('product');
  opptyValue = ApexPages.currentPage().getParameters().get('OpptyId');
  </code></pre>
  
  <p>and these fields are then used in javascript as</p>
  
  <pre><code>function setValue()
  {
      var productId = '{!productValueId}';
      window.parent.opener.document.getElementById(productId).value='{!productValue}';
  }
  </code></pre>
  
  <p>where <code>{!productValue}</code> is taken from controller.</p>
  
  <p>I am not understanding how and where should i make changes for soving my checkmarx issue.</p>
  
  <p>So, please help me as I would want to submit the application for code review.</p>
  
  <p>Best Regards</p>