SOSL Injection

Executing SOSL queries with data from untrusted sources may allow access to unauthorized data.

Salesforce Object Search Language (SOSL) is the Salesforce platform search language that is used to perform text searches in records. Use SOSL to search fields across multiple standard and custom object records in Salesforce.

Salesforce Object Search Language (SOSL) injection errors occur when:

1. Data enters a program from an untrusted source.


2. The data is used to dynamically construct a SOSL query without any pre-processing or sanitization.
Example 1: The following code dynamically constructs and executes a SOSL query that searches for contacts with a specified name.

...
public String inputValue {
  get { return inputValue; }
  set { inputValue = value; }
}
...
String queryString = 'Name LIKE \'%' + inputValue + '%\'';
String searchString = 'Acme';
String searchQuery = 'FIND :searchString IN ALL FIELDS RETURNING Contact (Id WHERE ' + queryString + ')';
List<List<SObject>> results = Search.query(searchQuery);
...

This code intends to execute the query as follows:

String searchQuery = 'FIND :searchString IN ALL FIELDS RETURNING Contact (Id WHERE Name LIKE '%' + inputValue + '%')';

However, because the query is constructed dynamically by concatenating a constant base query string and a user input string, the query only behaves correctly if inputValue does not contain a single-quote character. If an attacker enters the string 1%' OR Name LIKE ' for inputValue, then the query becomes the following:

String searchQuery = 'FIND :searchString IN ALL FIELDS RETURNING Contact (Id WHERE Name LIKE '%1%' OR Name LIKE '%%')';

The addition of the OR Name like '%%' condition causes the where clause to use the LIKE '%%' condition, which will force the query to output all the records that contain phrase 'map', since it becomes logically equivalent to the much simpler query:

FIND 'map*' IN ALL FIELDS RETURNING Contact (Id WHERE Name LIKE '%%')

Unlike most of database interfaces, SOSL in the force.com platform does not support multiple SOSL statements separated by semicolons, which means that it is not possible to concatenate several commands in a single query as is the case with regular SQL injection attacks. Also, note that Apex database does not support comments, so every single quote, parenthesis or other special character must be paired.