2

Here I have done get;set; with "selectedEvent" which is a selected value of the Picklist, which can be TODAY, THIS_WEEK, THIS_MONTH or NEXT_MONTH which are standard things which I can use in SOQL to get records whre dateField = Today or dateField=THIS_WEEK. I got records perfectly all the time in each condition, but the scanner cause "SOQL-SOSL Injection" Security Issue. I have seen their example (but its confusing), then I tried following two ways which still causes the same issue, Any Suggestion,.

1)

String query = 'select id, Name, DOB__c from Contact where DOB='+ selectedEvent;

2)

    //to avoid SOQL_SOSL Injection issue
    String selectedEventStr='=' + String.escapeSingleQuotes(selectedEvent);   
    String query = 'select id, Name, DOB__c from Contact where DOB'+ selectedEventStr;
3
  • Will 2nd Solution work, I am doubtfull with that so I haven't checked it with Security Scanner yet. Aug 7, 2014 at 10:01
  • Try changing the second one to String query = 'select id, Name, DOB__c from Contact where DOB = '+ String.escapeSingleQuotes(selectedEvent); Aug 7, 2014 at 10:46
  • Did you manage to get your code through the scanner this time? Aug 8, 2014 at 10:39

2 Answers 2

3

If you change your second example to the following it should pass (I've just run it through the security scanner myself and no errors were indicated).

The key to placating the security scanner is to escape everything this is being passed to your query and include as much as you can (such as the = sign) in your original query string as possible.

String query = 'select id, Name, DOB__c from Contact where DOB = ' +
                  String.escapeSingleQuotes(selectedEvent);
2
  • Yes, earlier '=' was in original query string itself, OK ,then Let me go throw scanner! I can understand this with "text box input values e.g. name", what does picklist has to do with SingleQuotes. Aug 7, 2014 at 11:58
  • @NileshMendhe Because Apex runs in a system context you need to be very careful, even with picklists. A picklist can effectively be any string value and you can't control all values that someone with malicious intent could change it to. A rogue user with access to the setup menu could change the picklist to do something malicious for example. Aug 7, 2014 at 12:34
2

In general (but as Alex Tennant points out not applicable in this case) using bind parameters avoids the need for the escaping. In static SOQL you can bind expressions, but dynamic SOQL is more limited in that you can only bind simple variables.

So for your example this will work (and should not be flagged by the security scanner and if it is you can report it as a false positive):

String selectedEvent = ...;
String query = 'select id, Name, DOB__c from Contact where DOB = :selectedEvent';
4
  • Using bind variables in this way will bind them as Strings and surround them in single quotes. This doesn't work for the special date constants such as TODAY and THIS_MONTH refered to in this question. Aug 7, 2014 at 23:56
  • @AlexTennant Missed that - thanks and +1 for your answer. Updated my answer rather than deleted it as sometimes people appear to be unaware of binding for dynamic SOQL in general.
    – Keith C
    Aug 8, 2014 at 6:52
  • Agreed. It's a feature that I can't believe so many developers don't make use of when they can! Aug 8, 2014 at 8:48
  • I have a crazy idea... What if I had 10 parameters.. Would using String.format be safe? query = String.format( 'select id from Contact where a = :{0} and b=:{1}', new String[]{ someParam1,someParam2}); Or should I escape quotes in the array? Even more crazy What if param3 was a condition ' OR c = : aVariable '
    – user682217
    Dec 22, 2014 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.