How to fix SOQL Query Stored XSS

Question

I have given my code for Security code Scanner but it is given the following error due to

String attachmentQuery = 'SELECT id,E2CAdv__Attachment__c, E2CAdv__CaseId__c, E2CAdv__Attachment_links__c, E2CAdv__Comment__c FROM E2CAdv__Comment_Attachments__c WHERE E2CAdv__Comment__c =:caseCommentIds';
List<E2CAdv__Comment_Attachments__c> attachmentData = Database.query(attachmentQuery);
               

for(E2CAdv__Comment_Attachments__c att : attachmentData){
    links.add(att.E2CAdv__Attachment_links__c);
 }

Answer 1

For me, it looks like most probably is a false positive. If you change your code to be:

for(E2CAdv__Comment_Attachments__c att : [SELECT id,E2CAdv__Attachment__c, E2CAdv__CaseId__c, E2CAdv__Attachment_links__c, E2CAdv__Comment__c FROM E2CAdv__Comment_Attachments__c WHERE E2CAdv__Comment__c =:caseCommentIds]) { 
    links.add(att.E2CAdv__Attachment_links__c); 
}

The issue will most probably dissapear.

The scanner will usually report every reference to Database.query where the String query passed as an argument is not directly single quotes escaped, but changing string query by the example above should fix your problem.