Execute SOQL using REST API and possible security implications

Question

I am trying to use REST API Query resource to execute SOQL query. From the documentation I see that query is passed as query parameter in the GET call. This will be used from the external system to connect to SFDC and sent the GET request to get the query result.

https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/dome_query.htm

I am trying to understand the security implications of this approach where SOQL query is passed as query parameter string without any bind variables etc. Risks around SOQL injection etc.

Can someone shed some light on this approach ?

Answer 1

SOQL is inherently more secure than SQL. There are no DML operations, so you can't perform insert, update, upsert, delete, undelete, or merge operations via SOQL. In addition, SOQL will not allow you to select from fields that you don't have access to, nor return rows you don't have access to. Conceptually, this means that SOQL is just as secure as using the user interface and running reports. Of course, developers should still take care to escape characters correctly because the user might get invalid query errors or return more or fewer records than expected. However, in no case can SOQL be manipulated to show records or fields that are not visible to the user. The takeaway here is that administrators must properly use security, including Object and Field permissions, Sharing Settings, Role Hierarchy, etc.