0

I have a method where I am fetching the Id from the URl and using page reference method as below.

Public test_method() {
    Id = ApexPages.currentPage().getParameters().get('id');
    PageReference returnPage = new PageReference('/lightning/r/Lead/' + ID+ '/view');
}

Our static code analysis is giving me Improper Control of Resource Identifiers ('Resource Injection'). Is this a false positive ?

Thanks!

Improve this question

1 Answer 1

Reset to default
3

According to the definition:

The software receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

You are using the id that is given as a parameter, to construct a URL. If there is some way something can manipulate what is passed as id, then the warning/error is correct. But I don't think the analyzer has any way of knowing that when it is analyzing this Apex code, so it is raising the warning/error to be on the safe side.

If you are sure that the id can always be trusted, then it's a false positive. Otherwise your Apex code would have to perform some sanity checks on it, to make sure it's a proper id.

Improve this answer
2
  • 2
    I would declare the variable's data type as Id, which should be foolproof enough.
    – sfdcfox
    Jul 15, 2020 at 14:20
  • Indeed, without specifying it as an Id (and therefore having ID validation applied) in principle any value could be passed as the "id" parameter.
    – Phil W
    Jul 15, 2020 at 15:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .