2

In my app, I get passed in user-generated SOQL query strings and need to validate and modify them. For that, I would need a parser that can extract me chunks They contain many SOQL features like:

  • Query Parent Object fields
  • Query Child records
  • Conditions in own and child relationships
  • Aggregate functions

I tried to:

  1. "hack my own parser" and FAILED
  2. tried to port an open-source parser from Java to Apex and FAILED

Now I need your help to eighter point me to an existing solution that I didn't find yet or help me understand how to make 1) or 2) work.

Please also don't close-vote this question as too broad. Nobody is harmed when we leave it to hang around. Eventually, someone will be motivated by it to write such a parser.

3

I would really advise you not to do this.

Apex in its current form is really not suited for parsing and - more importantly - user-generated SOQL strings is a big security red flag. I know it's probably not the answer you wanted, but my advice would be to have a user-generated object-representation of the query (for example, an object representation of the fields, the objects, the filters, etc) and generate the SOQL downstream. This would avoid the parsing problem entirely and let you handle security robustly.

Plus, it's a fun object-oriented design exercise.

| improve this answer | |
  • 3
    Totally agree with this. You need an abstraction of the query pieces to 1) ensure you don't break security and 2) to make it easier for the users to generate and submit the data. – Phil W Jul 17 at 9:24
  • 2
    @Lorenzo: I am hearing what you are saying but building a Custom Object or event Custom Metadata Structure to build even a simple SELECT fields FROM object WHERE X=Z is super hard. Imagine the UI you need to build, the checks to not create invalid statements. And Entity and Field relationships on CMDT will need another 5 years to come near that. Why not just use the Standard means to prevent SOQL injection and the like? – Robert Sösemann Jul 17 at 12:39
  • 2
    @Lorenzo: it would also be nice if you could elaborate (at least) a bit on why Apex is so bad for parsing. Which language features are missing to make it work? Generics? I have seen them used in the Mulesoft Java Parser for Soql. – Robert Sösemann Jul 17 at 14:52
  • 2
    @Robert Sösemann I actually think we should have more broad questions like this to increase discussions. Chat rooms and other meta features are rarely used. – Atlas Can Jul 18 at 11:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.