I am getting error as "SampleClass.cls Method sampleMethod at line 3 of classes\SampleClass.cls gets user input from the strVar element. This element’s value then flows through the code without being properly sanitized or validated, and is eventually used in a database query in method sampleMethod at line 3 of classes\SampleClass.cls. This may enable an SOQL Injection attack. line no: 2, 5, 6" in checkmarx report.

public class SampleClass {
    public String strVar {get; set;};
    public void sampleMethod(){
        if (strVar != null){     
            strVar = strVar.trim();
            List<String> varList = strVar.split(' ');   
            String str1;
            String qString =  'select id, Description FROM Account';
            if (varList.size() == 1){
                str1 = varList.get(0);
                queryStr+= ' and (Account.Name like \'%' + str1 + '%\')'; 

Technically, you're at risk for SOQL injection, hence this error. You've mitigated it somewhat by only allowing a single word, but you might still run in problems if someone tries to use an apostrophe ("single quote"), such as 'hello. This would render the query filter as Name LIKE '%'hello%', which would cause an error. You need to remember to use String.escapeSingleQuotes.

queryStr+= ' and (Account.Name like \'%' + String.escapeSingleQuotes(str1) + '%\')'; 

See this trailhead.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.