0

I have given my code for Security code Scanner but it is given the following error due to

String attachmentQuery = 'SELECT id,E2CAdv__Attachment__c, E2CAdv__CaseId__c, E2CAdv__Attachment_links__c, E2CAdv__Comment__c FROM E2CAdv__Comment_Attachments__c WHERE E2CAdv__Comment__c =:caseCommentIds';
List<E2CAdv__Comment_Attachments__c> attachmentData = Database.query(attachmentQuery);
               

for(E2CAdv__Comment_Attachments__c att : attachmentData){
    links.add(att.E2CAdv__Attachment_links__c);
 }

enter image description here

6
  • Hi and welcome to SFSE. Please edit your question to show how you generate the attachmentQuery- there will be some direct concatenation of a value without encoding single quotes or something like that.
    – Phil W
    Nov 20 '20 at 8:55
  • Not as a comment. Edit the question.
    – Phil W
    Nov 20 '20 at 9:00
  • OK, so what is the context of execution for this query and where do the results go?
    – Phil W
    Nov 20 '20 at 9:04
  • I am adding full code with problem screenshot.
    – Sonu Sagar
    Nov 20 '20 at 9:16
  • Can you include the full stack trace that Checkmarx generated? There is something about the collected links and how it is used that Checkmarx doesn't like. Have you looked at their documentation on XSS?
    – Phil W
    Nov 20 '20 at 9:22
0

For me, it looks like most probably is a false positive. If you change your code to be:

for(E2CAdv__Comment_Attachments__c att : [SELECT id,E2CAdv__Attachment__c, E2CAdv__CaseId__c, E2CAdv__Attachment_links__c, E2CAdv__Comment__c FROM E2CAdv__Comment_Attachments__c WHERE E2CAdv__Comment__c =:caseCommentIds]) { 
    links.add(att.E2CAdv__Attachment_links__c); 
}

The issue will most probably dissapear.

The scanner will usually report every reference to Database.query where the String query passed as an argument is not directly single quotes escaped, but changing string query by the example above should fix your problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.