New answers tagged

3

Mohith is correct that this isn't a simple "false positive" and you do need to engineer the use of the setting/property appropriately. Since this is actually looking to provide a filter, and thus is providing content for an SOQL (or SOSL) WHERE clause, this needs to be handled in a different way to handling security concerns for user inputs that ...


4

No this is not a false positive and your app can fail Salesforce security review process due to this! Since this is a user input there are chances that users can put in a SOQL that can have a security flaw! It's always recommended you put enough guardrails and security checks in your code. I would make sure to adopt techniques such as character replace or ...


Top 50 recent answers are included