I have given my code for Security code Scanner but it is given the following error due to

Query: Stored XSS

My query is like this.

loan=Database.query('SELECT Name, fintechLLC__Application__c, '+
                          'fintechLLC__Legal_Corporate_Name__c, '+
                          'fintechLLC__Last_Month_Trans__c, '+
                          'fintechLLC__X2_Month_ago_Trans_del__c, '+
                          'fintechLLC__X3_Month_ago_Trans__c, '+
                          'CreatedDate,fintechLLC__Monthly_Ending_Bal__c,Max_Rate__c, '+
                          'fintechLLC__Term__c,fintechLLC__Funding_Amount__c, '+
                          'fintechLLC__Business_DBA_Name__c,fintechLLC__Credit_Score__c, '+
                          'fintechLLC__Business_DBA_Years_in_Business__c, '+
                          'fintechLLC__Avg_Daily_Bank_Bal__c '+
                    'FROM fintechLLC__Loan__c '+
                    'WHERE id=\''+loanId+'\'');

Kindly help me in this

  • Is there any specific requirement for using Dynamic SOQL rather than standard SOQL? – highfive May 31 '16 at 9:18

What is type of loanId and where does it code from? Is it a String or an Id?

Since you are using it to build a dynamic SOQL query you need to be extremely cautious with it. Especially since you have lots of terms like "Loan", "Bank", "Bal", "Credit_Score" in there.

For example, if it was a string from the URL query string I could try setting it to something like:

string loanId = '\' or ID!=\'\'';

Now that query will return all the fintechLLC__Loan__c records.

Is there a reason you need to use dynamic SOQL? As an alternative, you could use inline SOQL and using the Id type for loanId if you aren't already.

Id loanId = \\...
List<fintechLLC__Loan__c> loans = [SELECT Name, fintechLLC__Application__c,
                FROM fintechLLC__Loan__c 
                WHERE id=:loanId 
                limit 1];

Now it would only be possible to have an Id go into that query. Since you are asking for a single record, your could be extra cautious and add a limit as well. This is mostly superfluous though.

See also: SOQL Injection

| improve this answer | |
  • loanID is a String where i am storing the RecordId – Shantanu Mahajan May 31 '16 at 9:06
  • 1
    Change it to be a strongly typed Id rather than a string and avoid the dynamic SOQL (Database.query) unless you really need it. – Daniel Ballinger May 31 '16 at 9:09

your dynamic query will fail to read loanId and also instead of using Database.query(query) use the below method to get dynamic soql query result as list

Syntax should be like ..

List<custom_object> cu_list = [Select id, name from custom_object where id=:loanId] 
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.