How to use the escapeSingleQuotes method?

Question

I'm trying to use this method in a dynamic SOQL query. Follow the sample code:

public static String getRowById(String sobjName, id id) {
    String query = 'SELECT ';            
    Map<String, Schema.SObjectField> objectFields =
        Schema.getGlobalDescribe().get(sobjName).getDescribe().fields.getMap();
    for (String f : objectFields.keySet()) {
        query += f;
        query += ',';
    }

    query = query.substring(0, query.length() - 1);
    query += ' FROM '+ sobjName;
    query += ' WHERE id = \'' + String.escapeSingleQuotes(id) + '\'';
    query += ' LIMIT 1';

    return query;
}

The problem is that this is still considered as a SOQL Injection vulnerability.

Am I missing something here? I also tried to use it as a parameter like this:

getRowById('SFT_Brand__c',
    String.escapeSingleQuotes(ApexPages.currentPage().getParameters().get('id')));

Answer 1

You are using it correctly. Here's a simplified version of your script, using the new String.join() method and all of the string concatenations in one statement instead of spread out over multiple statements.

public static String getRowById(String sobjName, Id id) {
    Map<String, Schema.SObjectField> objectFields =
        Schema.getGlobalDescribe().get(sObjName).getDescribe().fields.getMap();

    return 'SELECT ' + String.join( objectFields.keySet(), ', ')
           + ' FROM ' + sObjName
           + ' WHERE Id = \'' + String.escapeSingleQuotes(Id) + '\''
           + ' LIMIT 1';
}

You are correctly escaping the id parameter, but that might not even be necessary, since it's an Id and not a String.

This looks to me like a false positive by the security scan. If someone disagrees, they should provide a sample exploit that:

• Doesn't throw an exception when sObjName is used to get the field list.
• Accepts an invalid Id (15 or 18-character alphanumeric) as the second parameter.