3

I'm facing an issue on code scanning. The following code has second order error.

TestList = [SELECT Id, name, address FROM Object__c where Id IN: TestIddSet];

TestList is a list of the Object__c. TestIddSet is a set of ids

I made it into a dynamic query instead, because I found out that using escapeSingleQuotes passes code review.

String queryString = 'SELECT Id, name, address FROM Object__c where Id IN: TestIddSet';
TestList = database.query(String.escapeSingleQuotes(queryString));

Is this the correct approach?

Improve this question
5
  • what was an original issue that security scanner displayed?
    – kurunve
    Jul 19, 2016 at 11:30
  • It says as "Second Order SOQL SOSL Injection"
    – MnZ
    Jul 19, 2016 at 11:33
  • 3
    Is there any more information in the scan results? I thought the first query was fully protected from injection attacks and was generally a cleaner approach than using escapeSingleQuotes. If this was my code, I'd book a Security Office Hours meeting to get an explanation.
    – Keith C
    Jul 19, 2016 at 11:59
  • 2
    Calling `escapeSingleQuotes does nothing. Except maybe appease naive scanner technology.
    – Adrian Larson ♦
    Jul 19, 2016 at 11:59
  • 4
    I think it is false positive -- you already have set of ID, and it impossible to do injection. Check this answer -- salesforce.stackexchange.com/questions/8505/…. In case, if TestIddSet is set of string, you can escape that one by one, but you already have ids.
    – kurunve
    Jul 19, 2016 at 12:00

1 Answer 1

Reset to default
3

Sounds like a false positive here. I'm not sure what type TestIddSet is, but if it's Set<String> consider changing it to Set<Id>, that way there can be no injection and if for some reason the scanner flags this you can definitely get it discarded as a false-positive.

The scanner is not perfect and I've had to get a few false positives dismissed in the past by having phone calls with the security review team.

Improve this answer
1
  • 1
    TestIddSet is of type Set<Id>. Also, I wrote a mail to securecloud@salesforce.com. Turned out to be false positive. Thanks for your help!
    – MnZ
    Jul 23, 2016 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.