0

I am facing a issue of SOQL injection in my dyanmic query.

Code is : -

 if(opportunity.Mass_Update__c != null) { //Checking for Created date not null

       //Checking for conditions and field type DATETIME
       if(mapOppFieldWithType.containsKey(fieldName) && mapOppFieldWithType.get(fieldName) == Schema.DisplayType.DateTime)
             query += fieldName +' >= '+ opportunity.Mass_Update__c.format('yyyy-MM-dd\'T\'HH:mm:ss\'Z\'')+' AND '; 

       //Checking for conditions and field type DATE
       else if(mapOppFieldWithType.containsKey(fieldName) && mapOppFieldWithType.get(fieldName) == Schema.DisplayType.Date) {

           dt1 = opportunity.Mass_Update__c.Date();
           query += fieldName +' >=: dt1 AND '; 
       }
 }

Where I am adding up in query, security scanner gives an error.

1
  • Is the line after the first if is giving the exception? Commented Sep 13, 2017 at 10:03

2 Answers 2

2

The Salesforce security scanner does not always interpret the source of a variable correctly, which is why they expect a False Positive document to be attached to review requests.

I believe Alexander is correct, that using your variable in your SOQL is the issue, but it is a false positive, and can be documented as such, if you created the variable yourself from a code-based source.

The idea here is that if any malicious user has the ability or access to change what populates that field (by url parameter, UI option, or even with access to the Saleforce Objects themselves) then they could create a malicious value that would cause your SOQL to become vulnerable.

If there is no way that a user could change the contents of that variable in any way, then it would be a false positive and documenting it as such should be sufficient for a security scan.

If someone CAN control or affect the contents of that variable, then it needs to be validated in some way or handled as "untrusted."

(dt1 would have the same risk if it were pulling from a text field, but since it's sourced from a validated date then it's considered safe from injection)

0

I think problem is with passing fieldName to query. Use binding (as you used it for dt1 variable) to prevent harmful values to be set for fieldName variable:

if(opportunity.Mass_Update__c != null) {
    if(mapOppFieldWithType.containsKey(fieldName) && mapOppFieldWithType.get(fieldName) == Schema.DisplayType.DateTime) {
        query += ':fieldName >= '+ opportunity.Mass_Update__c.format('yyyy-MM-dd\'T\'HH:mm:ss\'Z\'')+' AND '; 
    } else if(mapOppFieldWithType.containsKey(fieldName) && mapOppFieldWithType.get(fieldName) == Schema.DisplayType.Date) {
        dt1 = opportunity.Mass_Update__c.Date();
        query += ':fieldName >= :dt1 AND '; 
    }
}

There are nice articles about preventing SOQL Injections:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .