@
Summary
escapeSoqlString only replaces single quotes with backslash-escaped quotes but does not escape literal backslashes, allowing an attacker-controlled value to inject arbitrary SOQL fragments.
Detail
The function escapeSoqlString performs s.replace(//g, "\"). A value like test\ OR Name != NULL -- passes through unchanged (no quote to trigger the replacement) and produces a valid SOQL expression that alters query logic. Because the builder embeds user-supplied field values directly into SOQL strings sent to Salesforce, any record data or UI input flowing into WHERE conditions can modify the query semantics. This is distinct from the already-filed rawCall issue because it affects the structured query builder path, not the REST explorer.
Location
src/ui/utils/soqlBuilder.ts:178
Reproduction
In the query builder, set a text field condition to value test\ OR Name != NULL --. The generated SOQL will contain WHERE Field = test\ OR Name != NULL -- which Salesforce parses as Field = test OR Name != NULL, returning all records instead of filtering.
Suggested Fix
Escape backslashes before escaping quotes: return s.replace(/\/g, \\).replace(//g, "\");. Alternatively, use parameterized queries where the Salesforce API supports them.
Verification
REFUTED(high): Verified escapeSoqlString at src/ui/utils/soqlBuilder.ts:221-223 only escapes single quotes. In Sale | REAL(high): Verified end-to-end exploitability: (1) escapeSoqlString at src/ui/utils/soqlBuilder.ts:221-223 only | REAL(high): Confirmed via code tracing: escapeSoqlString (lines 221-223) only escapes single quotes, not backsla
🤖 Found by automated codebase audit (Claude Fable 5.1)
@
@
Summary
escapeSoqlString only replaces single quotes with backslash-escaped quotes but does not escape literal backslashes, allowing an attacker-controlled value to inject arbitrary SOQL fragments.
Detail
The function
escapeSoqlStringperformss.replace(//g, "\"). A value liketest\ OR Name != NULL --passes through unchanged (no quote to trigger the replacement) and produces a valid SOQL expression that alters query logic. Because the builder embeds user-supplied field values directly into SOQL strings sent to Salesforce, any record data or UI input flowing into WHERE conditions can modify the query semantics. This is distinct from the already-filed rawCall issue because it affects the structured query builder path, not the REST explorer.Location
src/ui/utils/soqlBuilder.ts:178Reproduction
In the query builder, set a text field condition to value
test\ OR Name != NULL --. The generated SOQL will containWHERE Field = test\ OR Name != NULL --which Salesforce parses asField = test OR Name != NULL, returning all records instead of filtering.Suggested Fix
Escape backslashes before escaping quotes:
return s.replace(/\/g, \\).replace(//g, "\");. Alternatively, use parameterized queries where the Salesforce API supports them.Verification
REFUTED(high): Verified escapeSoqlString at src/ui/utils/soqlBuilder.ts:221-223 only escapes single quotes. In Sale | REAL(high): Verified end-to-end exploitability: (1) escapeSoqlString at src/ui/utils/soqlBuilder.ts:221-223 only | REAL(high): Confirmed via code tracing: escapeSoqlString (lines 221-223) only escapes single quotes, not backsla
🤖 Found by automated codebase audit (Claude Fable 5.1)
@