-1

While passing the app, I am still getting SOQL Injection errors in checkmarx. Please advise why this is:

L 435: query += fmw.LeadFieldName + ', ';

L 437: query = query.substring(0 , query.length()-2);

L 439: leadRecord = Database.query(query);

// code

public Class FieldMappingWrapper{
    public String LeadFieldName { get; set; }
    public String AccountFieldName { get; set; }
    public String ContactFieldName { get; set; }
    public String OpportunityFieldName { get; set; }
    //public String customObjectFieldName { get; set; }
    //public String customObjectName { get; set; }
}

// selected field and picklists 
public Class FieldMappingWithSelectOptionWrapper{
    public FieldMappingWrapper selectedAllFeild { get; set; }
    public List<SelectOption> leadFieldOptions { get; set; }
    public List<SelectOption> accountFieldOptions { get; set; }
    public List<SelectOption> contactFieldOptions { get; set; }
    public List<SelectOption> opportunityFieldOptions { get; set; }
    //public List<SelectOption> customObjectFieldsOptions { get; set; }
}

private void convertLead( Field_Mapping__c fm ){

    Database.LeadConvert lc = new Database.LeadConvert();
    lc.setLeadId(leadRecord.id);

    LeadStatus convertStatus = [SELECT Id, MasterLabel FROM LeadStatus WHERE IsConverted=true LIMIT 1];
    lc.setConvertedStatus(convertStatus.MasterLabel);

    Database.LeadConvertResult lcr = Database.convertLead(lc);
    System.assert(lcr.isSuccess());

    //Account acc = new Account( Id = lc.getAccountId() );
    //Contact cont = new Contact( Id = lc.getContactId() );
    //Opportunity opp = new Opportunity( Id = lc.getOpportunityId() );

    List<FieldMappingWrapper> fieldMappingWrappers = (List<FieldMappingWrapper>)JSON.deserialize( fm.Field_Mapping_Json__c , List<FieldMappingWrapper>.Class);
    String query = 'SELECT ConvertedAccountId, ConvertedContactId, ConvertedOpportunityId, ';
    for( FieldMappingWrapper fmw : fieldMappingWrappers ){
        query += fmw.LeadFieldName + ', ';
    }
    query = query.substring(0 , query.length()-2);
    query += ' From Lead where Id = \'' + LeadRecord.Id + '\'';
    leadRecord = Database.query(query);
2

You need to escape the values that you are using to construct the query to prevent an attacker supplying malicious data that would result in unexpected action or returning additional data fields. In your code, it appears you need to escape fmw.LeadFieldName using the String.escapeSingleQuotes() method.

  • Please have a look at updated code – Salesforce Things Feb 16 '18 at 15:05
  • You don't appear to have updated your code to perform any additional security checks per the two answers you've received. – David Reed Feb 16 '18 at 15:08
1

When building a dynamic query, always make sure the user can access the fields, otherwise they may expose data not meant to be seen:

Map<String, SOBjectField> fields = SObjectType.Lead.fields.getMap();
for(Wrapper fmw: userSelectedValues) {
  SObjectField field = fields.get(fmw.LeadFieldName);
  if(field != null && field.getDescribe().isAccessible()) {
    query += field + ',';
  }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.