New answers tagged dynamic-soql
3
Mohith is correct that this isn't a simple "false positive" and you do need to engineer the use of the setting/property appropriately. Since this is actually looking to provide a filter, and thus is providing content for an SOQL (or SOSL) WHERE clause, this needs to be handled in a different way to handling security concerns for user inputs that ...
4
No this is not a false positive and your app can fail Salesforce security review process due to this!
Since this is a user input there are chances that users can put in a SOQL that can have a security flaw!
It's always recommended you put enough guardrails and security checks in your code.
I would make sure to adopt techniques such as character replace or ...
answered Dec 24 '20 at 16:28
Mohith Shrivastava
77.2k1212 gold badges124124 silver badges172172 bronze badges
Top 50 recent answers are included
Related Tags
dynamic-soql × 418soql × 258
apex × 249
visualforce × 42
query × 32
trigger × 16
sosl × 15
soql-injection × 15
dynamic-apex × 14
batch × 12
dynamic-visualforce × 11
sobject × 10
community × 8
schema × 8
governorlimits × 7
list × 7
describesobject × 7
dynamic-binding × 7
relationships × 6
string × 6
aggregate × 6
customsetting × 5
search × 5
database × 5
lightning-aura-components × 4