0

I am getting SOQL injection vulnerability on source scanner report. Please check one of the issue below. I tried string.escapeSingleQuotes() on query string. It is helping with removing this issue in source scanner report but test classes are failing with no viable alternative at character '\' error. So unable to create a managed package with string.escapeSingleQuote() on query string.

Object: newdraggableelementlist in file: classes/EsignWithSelectedTemplate.cls

L 593: String recId,List<String> newDraggableElementList)

Object: newdraggableelementlist in file: classes/EsignWithSelectedTemplate.cls

L 729: if(newDraggableElementList.size()!=0){

Object: newdraggableelementlist in file: classes/EsignWithSelectedTemplate.cls

L 730: for(String es:newDraggableElementList){

Object: es in file: classes/EsignWithSelectedTemplate.cls

L 733: newApiList.add(es);

Object: newapilist in file: classes/EsignWithSelectedTemplate.cls

L 750: for(String field:newApiList){

Object: field in file: classes/EsignWithSelectedTemplate.cls

L 751: if(field.subStringBefore('.')=='Account'){

Object: field in file: classes/EsignWithSelectedTemplate.cls

L 752: accountApiList.add(field.subStringAfter('.'));

Object: accountapilist in file: classes/EsignWithSelectedTemplate.cls

L 768: String accQueryString = String.join((Iterable<String>)accountApiList,',');

Object: accquerystring in file: classes/EsignWithSelectedTemplate.cls

L 779: acc = Database.query('SELECT '+accQueryString+' FROM Account WHERE id =\''+String.escapeSingleQuotes(recId)+'\'');

instead of just recId, if I set total query string in escapeSingleQuotes, source scanner is not reporting as a vulnerability. but test classes is failing as I mentioned above. How to fix this issue? Where do I need to use String.escapeSingleQuotes() if I have to use only that method. Please advice.

3
  • This is probably a false positive. See this question for more info salesforce.stackexchange.com/questions/55234/…
    – manjit5190
    Mar 27 '20 at 7:39
  • Putting entire query in escape single quotes is not right because that would invalidate the query if there are any single quotes.
    – manjit5190
    Mar 27 '20 at 7:40
  • Yes. I am not putting entire query in singleQuote anymore as I mentioned in the post.
    – AshSFcloud
    Mar 31 '20 at 7:32
0

You can use simple bind variables in dynamic SOQL query strings. So it would work if you change the query as follows.

Database.query('SELECT '+accQueryString+' FROM Account WHERE id = :recId');
2
  • This didn't worked for me. "L 779: acc = Database.query('SELECT '+accQueryString+' FROM Account WHERE id =:recId'); //'+String.escapeSingleQuotes(recId)+'\'');" is it because of commented part of line?? If not, it didn't fixed the issue.
    – AshSFcloud
    Mar 29 '20 at 8:27
  • @AshSFcloud Well, the scanner ignores the commented lines. Mar 31 '20 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.