1

We are using a third party company to scan our salesforce code for SOQL Injection and Vulnerability issues with open page redirects. The below code is flagged as a vulnerability.

public Pagereference customCancel() {
    Pagereference objPageref = new Pagereference('/apex/FulcrumInlineEdit?id='+OptyId);
    objPageref.setRedirect(true);
    return objPageref;
}

The page is not using any URL hacking mechanisms like saveUrl, retUrl or cancelUrl. Based on the information given in the trailhead Prevent Open Redirects in your code, I am not sure how to modify the above code to make it secure. Can someone help?

0

While I'd say the vulnerability tool is being overly-cautious here, it may be expecting you to construct the URL piecemeal, like so:

public PageReference customCancel() {
    PageReference objPageref = Page.FulcrumInlineEdit;
    objPageref.getParameters().put('id', OptyId);
    objPageref.setRedirect(true);
    return objPageref;
}

It's also likely that OptyId is of type String when ideally it should be of type Id (I'm assuming by the name that it's an Opportunity record Id), which would ensure nothing malicious could potentially be passed in.

| improve this answer | |
  • Thanks for your response and I will try this. And yes, OptyId is of type Id and it is the Opportunity Record Id. – Balaji Pooruli May 8 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.