2

I have send my code for security review I am getting error for SOQL/SOSL Injection. I have made the changes on the bases they have mention in report. But even I am getting issue with dynamic soql I am doing in my code. My updated code :

    string userId = String.escapeSingleQuotes(UserInfo.getUserId());        
    String queryString = 'Select Conference_Call__c,Conference_Call_Info_Details__c,Meeting_Date__c,Id,Meeting_Id__c,StartDateTime__c,EndDateTime__c,Subject__c,Type__c,Conference_Call_Info__c from GoTo_Meeting__c where OwnerId= :userId';       


    if(optionSelected == 'Meeting History')
        queryString +=' and StartDateTime__c < Today'; 
    else if(optionSelected == 'Upcoming Meetings')
        queryString +=' and StartDateTime__c > Today'; 
    else
        queryString +=' and StartDateTime__c = ' +optionSelected; 

    queryString += ' order By ' + sortFullExp;
    queryString += ' Limit 1000';        
    eventList = database.query(queryString); 

security review is displaying the SOQL/SOSL Injection error on eventList = database.query(queryString); Can anyone please help me to solve this issue.

6

Dynamic SOQL will not pass the security review. Your code is pretty safe because the end user has no possible way of injecting anything into the query.

From here

If you must use dynamic SOQL, use the escapeSingleQuotes method to sanitize user-supplied input. This method adds the escape character (\) to all single quotation marks in a string that is passed in from a user. The method ensures that all single quotation marks are treated as enclosing strings, instead of database commands.

You will need to call escapeSingleQuotes on the entire query string. The security scanner is not smart enough to know that you have already called it on the only variable that can change in your query. You should be doing this:

eventList = database.query(String.escapeSingleQuotes(queryString)); 
1
  • Thanks, I have made the change and send the code for review. Will update after i receive report.
    – Anu
    Mar 24 '15 at 10:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.