New answers tagged dynamic-soql
3
Mohith is correct that this isn't a simple "false positive" and you do need to engineer the use of the setting/property appropriately. Since this is actually looking to provide a filter, and thus is providing content for an SOQL (or SOSL) WHERE clause, this needs to be handled in a different way to handling security concerns for user inputs that ...
4
No this is not a false positive and your app can fail Salesforce security review process due to this!
Since this is a user input there are chances that users can put in a SOQL that can have a security flaw!
It's always recommended you put enough guardrails and security checks in your code.
I would make sure to adopt techniques such as character replace or ...
answered Dec 24 '20 at 16:28
Mohith Shrivastava
77.2k12 gold badges124 silver badges172 bronze badges
Top 50 recent answers are included
