Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

Is there a way through the .net framework or some other package to sanitize strings so that they can be safely used in sosl? Is there any larger standard that SOSL falls under?

I was able to find How to pass a variable to the SOQL where clause? and Escaping reserverved characters in SOSL queries, but they both deal with solving specific cases rather than a general solution.

I would prefer not to roll my own solution.

share|improve this question
add comment

2 Answers 2

up vote 4 down vote accepted

From Dynamic SOSL - SOSL Injection:

SOSL injection is a technique by which a user causes your application to execute database methods you did not intend by passing SOSL statements into your code. This can occur in Apex code whenever your application relies on end user input to construct a dynamic SOSL statement and you do not handle the input properly.

To prevent SOSL injection, use the escapeSingleQuotes method. This method adds the escape character (\) to all single quotation marks in a string that is passed in from a user. The method ensures that all single quotation marks are treated as enclosing strings, instead of database commands.

Based on that is should be sufficient to escape any single quote characters in the user based input before merging it with your dynamic SOSL.

share|improve this answer
    
Is the escapeSingleQuotes method only available in the apex language? –  Ryan Gates Apr 16 at 14:19
    
That particular method is apex specific. In C# you would do something like s = s.Replace("'", @"\'"); –  Daniel Ballinger Apr 16 at 19:19
    
Yeah, that is what I'm doing now, but I would like to have it be more inclusive as technically the special characters go beyond ', without writing my own library. –  Ryan Gates Apr 16 at 19:23
    
I don't know of a library that includes such a function for C#. You might find something in the Salesforce Toolkits for .NET. Now I want to send the Bell character in to see I can make noises on the Salesforce servers. –  Daniel Ballinger Apr 16 at 20:02
    
I know, I couldn't believe the bell was in there, along with form feed. –  Ryan Gates Apr 16 at 21:28
add comment

These links should give you some good information on Injection.. For the most part I don't believe Salesforce has the same security risks because it doesn't use SQL, which does induce some limitations, while adding some security as a bi-product.

https://www.salesforce.com/us/developer/docs/pages/Content/pages_security_tips_soql_injection.htm

http://wikisf.blogspot.in/2012/08/preventing-soql-injection.html

Also check into the security scanner, personally I haven't used it but it may assist you.

http://security.force.com/security/tools/forcecom/scanner

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.