FAQ-001587 - SQL Injection and Input Validation / Best Practices and Prevention Strategies

The most common causes of SOQL injection and sharing violation vulnerabilities in Salesforce are: ### SOQL Injection Vulnerabilities: 1. **Insecure Query Construction**: Directly concatenating user input into SOQL queries without proper sanitization or validation. 2. **Unvalidated Input**: Using user-supplied data in a quoted string context or building dynamic SOQL queries with unvalidated input. **Prevention Tips**: - Use bind variables. - Sanitize input using methods like `String.escapeSingleQuotes()`. - Validate input against a whitelist of acceptable values. ### Sharing Violation Vulnerabilities: 1. **Bypassing Sharing Rules**: Marking Apex classes as "without sharing," which allows them to bypass sharing rules and access data beyond the intended scope. **Prevention Tips**: - Enforce sharing rules by using "with sharing" in Apex classes. - Perform CRUD (Create, Read, Update, Delete) and FLS (Field-Level Security) checks to ensure proper access controls. By addressing these causes, you can mitigate risks and secure your Salesforce applications.

The FAQ content is technically accurate and well-structured. No substantive changes are needed as the information aligns with current security best practices and the available security rules. The content clearly explains the two main vulnerability types (SOQL injection and sharing violations) with appropriate prevention techniques. Regarding the related security rules: 1. **ApexSOQLInjection rule**: This rule directly applies to the FAQ's discussion of SOQL injection vulnerabilities. The FAQ explains "Directly concatenating user input into SOQL queries without proper sanitization" and "Using user-supplied data in a quoted string context" which are exactly the patterns this rule detects. The prevention tips about using bind variables and sanitizing input with String.escapeSingleQuotes() directly address what this rule checks for. 2. **ApexSharingViolations rule**: This rule is directly relevant to the sharing violation section of the FAQ. The FAQ discusses "Marking Apex classes as 'without sharing'" and recommends using "with sharing" to enforce sharing rules, which aligns with what this security rule validates. The FAQ's guidance on performing CRUD and FLS checks also relates to the broader sharing security concepts this rule addresses.