0

I am getting SOQL injection vulnerability on source scanner report. Please check one of the issue below. I tried string.escapeSingleQuotes() on query string. It is helping with removing this issue in source scanner report but test classes are failing with no viable alternative at character '\' error. So unable to create a managed package with string.escapeSingleQuote() on query string.

Object: newdraggableelementlist in file: classes/EsignWithSelectedTemplate.cls

L 593: String recId,List<String> newDraggableElementList)

Object: newdraggableelementlist in file: classes/EsignWithSelectedTemplate.cls

L 729: if(newDraggableElementList.size()!=0){

Object: newdraggableelementlist in file: classes/EsignWithSelectedTemplate.cls

L 730: for(String es:newDraggableElementList){

Object: es in file: classes/EsignWithSelectedTemplate.cls

L 733: newApiList.add(es);

Object: newapilist in file: classes/EsignWithSelectedTemplate.cls

L 750: for(String field:newApiList){

Object: field in file: classes/EsignWithSelectedTemplate.cls

L 751: if(field.subStringBefore('.')=='Account'){

Object: field in file: classes/EsignWithSelectedTemplate.cls

L 752: accountApiList.add(field.subStringAfter('.'));

Object: accountapilist in file: classes/EsignWithSelectedTemplate.cls

L 768: String accQueryString = String.join((Iterable<String>)accountApiList,',');

Object: accquerystring in file: classes/EsignWithSelectedTemplate.cls

L 779: acc = Database.query('SELECT '+accQueryString+' FROM Account WHERE id =\''+String.escapeSingleQuotes(recId)+'\'');

instead of just recId, if I set total query string in escapeSingleQuotes, source scanner is not reporting as a vulnerability. but test classes is failing as I mentioned above. How to fix this issue? Where do I need to use String.escapeSingleQuotes() if I have to use only that method. Please advice.

  • This is probably a false positive. See this question for more info salesforce.stackexchange.com/questions/55234/… – manjit5190 Mar 27 at 7:39
  • Putting entire query in escape single quotes is not right because that would invalidate the query if there are any single quotes. – manjit5190 Mar 27 at 7:40
  • Yes. I am not putting entire query in singleQuote anymore as I mentioned in the post. – AshSFcloud Mar 31 at 7:32
0

You can use simple bind variables in dynamic SOQL query strings. So it would work if you change the query as follows.

Database.query('SELECT '+accQueryString+' FROM Account WHERE id = :recId');
| improve this answer | |
  • This didn't worked for me. "L 779: acc = Database.query('SELECT '+accQueryString+' FROM Account WHERE id =:recId'); //'+String.escapeSingleQuotes(recId)+'\'');" is it because of commented part of line?? If not, it didn't fixed the issue. – AshSFcloud Mar 29 at 8:27
  • @AshSFcloud Well, the scanner ignores the commented lines. – rahul gawale Mar 31 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.