SOQL injection in dynamic query

Question

I am facing soql injection issue in my dynamic query, i have done with sting.escapesinglequotes() also but still facing this issue. here is my code.

query: query = 'select id,Name,Owner.Id from ' + ObjectSelected + ' where ownerid =\'' + String.escapeSingleQuotes(objCurrentOwner) + '\'' +getfilters();

Method:

public string getfilters(){
       system.debug('inMethod@@@@');
       string filter = '';
       for(FilterWrapper fw:lstFldWrap){
           if(fw.field!='--select field--' && fw.operand!=NULL && fw.operand!='')
           {      

               if(fw.operator.contains('LIKE')){
                   if(!fw.operator.contains('NOT'))
                      {  filter+= ' AND '+fw.field+' '+fw.operator.replace('{val}',fw.operand);   }
                   else
                     {   filter+= ' AND (NOT '+fw.field+' '+fw.operator.replace('NOT','').replace('{val}',fw.operand)+')';   }
               }  
               else{

                   if(fieldMap.keyset().contains(fw.field))
                   {
                    string FldType = string.valueOf(fieldMap.get(fw.field).getDescribe().getType());

                   system.debug('ftype**'+FldType);                  
                   fw.operand = '\''+fw.operand+'\'';
                   system.debug('operand' +fw.operand);
                   if(FldType=='DATE' || FldType=='DATETIME' || FldType=='CURRENCY' || FldType=='DOUBLE' || FldType=='INTEGER'){
                       fw.operand  = fw.operand.replace('\'',''); 
                       system.debug('operand' +fw.operand);
                   }               
                   filter+= ' AND '+fw.field+fw.operator+fw.operand;

                   } 
               }                    
               system.debug('filter***' +filter);
             //  if(fw.field.contains('date'))
               //    filter = filter.replace('\'','');
           }   
       }       
        system.debug('Filter****' +filter);
        String.escapeSingleQuotes(filter);
        return filter;
    }

Answer 1

There are two tasks to achieve here:

1. To protect your code against SOQL injection while also having working code
2. To get your solution through a security review either by getting the automated security scanner to report no problems or to add a note about why the positive is a false positive

On 1), it is the fw.operand values that should be escaped not the overall filter string, otherwise you will be escaping quotes that should not be escaped. Your unit test cases for this code need to cover multiple permutations including ones with embedded quotes.

On 2), which is only worth doing once your are confident that your code is correct functionally and in relation to security, you may well end up having to explain a false positive report from the security scanner because its analysis of the code has limitations. But as long as the explanation you submit is clear (and references the test cases to demonstrate you have the problem solved) that will not stop your app getting through the overall security review process.