I am using a dynamic query in one of our AppExchange products.
There is an LWC component within our app, which has a property called filterLogic as below:
<targetConfig targets="lightning__RecordPage"> <property name="filterLogic" label="Filter Logic" type="String"/> </targetConfig>
Admin user can drag and drop the component on a Standard record page and in the properties for the component they can configure a filter logic as below:
Filter Logic: (Email <> NULL and RecordType.Name like 'Employee')
This filter logic will be used in an dyanmic query like below (sample code):
string strQuery = 'SELECT Name FROM Account WHERE ' + filterLogic; List<sObject> lstResult = Database.query(strQuery);
Question: As the field Filter Logic will be always under control of a Salesforce System admin user and not a business or community user, is it okay to add the above code as False Positive? Because, if we escapeSingleQuote for the above query, it will not work and we need to implement a custom implementation to generate dynamic filters.