Authentication Vulnerability Issue with Page Redirect

Question

We are using a third party company to scan our salesforce code for SOQL Injection and Vulnerability issues with open page redirects. The below code is flagged as a vulnerability.

public Pagereference customCancel() {
    Pagereference objPageref = new Pagereference('/apex/FulcrumInlineEdit?id='+OptyId);
    objPageref.setRedirect(true);
    return objPageref;
}

The page is not using any URL hacking mechanisms like saveUrl, retUrl or cancelUrl. Based on the information given in the trailhead Prevent Open Redirects in your code, I am not sure how to modify the above code to make it secure. Can someone help?

Answer 1

While I'd say the vulnerability tool is being overly-cautious here, it may be expecting you to construct the URL piecemeal, like so:

public PageReference customCancel() {
    PageReference objPageref = Page.FulcrumInlineEdit;
    objPageref.getParameters().put('id', OptyId);
    objPageref.setRedirect(true);
    return objPageref;
}

It's also likely that OptyId is of type String when ideally it should be of type Id (I'm assuming by the name that it's an Opportunity record Id), which would ensure nothing malicious could potentially be passed in.