phoedos/pmd
1
1
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Integers won't count as SOQL injection

Browse Source
This commit is contained in:
Sergey
2017-01-31 16:00:53 -08:00
parent 77bc558f68
commit 07100bc15d
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexSOQLInjectionRule.java
View File

@ -96,6 +96,10 @@ public class ApexSOQLInjectionRule extends AbstractApexRule {
if (literal != null) {
if (left != null) {
Object o = literal.getNode().getLiteral();
if (o instanceof Integer || o instanceof Boolean || o instanceof Double) {
safeVariables.add(Helper.getFQVariableName(left));
}
if (o instanceof String) {
if (SELECT_PATTERN.matcher((String) o).matches()) {
selectContainingVariables.put(Helper.getFQVariableName(left), Boolean.TRUE);

15
pmd-apex/src/test/resources/net/sourceforge/pmd/lang/apex/rule/security/xml/ApexSOQLInjection.xml
View File

@ -206,4 +206,19 @@ public class Foo {
}
]]></code>
</test-code>
<test-code>
<description>Dynamic SOQL with Integer
</description>
<expected-problems>0</expected-problems>
<code><![CDATA[
public class Foo {
public void test1() {
Integer field1 = 4;
Database.query('SELECT Id FROM Account LIMIT ' + field1);
}
}
]]></code>
</test-code>
</test-data>