SOQL string escaping omits backslashes, enabling injection via crafted field values #91

@

Summary

escapeSoqlString only replaces single quotes with backslash-escaped quotes but does not escape literal backslashes, allowing an attacker-controlled value to inject arbitrary SOQL fragments.

Detail

The function escapeSoqlString performs s.replace(//g, "\"). A value like test\ OR Name != NULL -- passes through unchanged (no quote to trigger the replacement) and produces a valid SOQL expression that alters query logic. Because the builder embeds user-supplied field values directly into SOQL strings sent to Salesforce, any record data or UI input flowing into WHERE conditions can modify the query semantics. This is distinct from the already-filed rawCall issue because it affects the structured query builder path, not the REST explorer.

Location

src/ui/utils/soqlBuilder.ts:178

Reproduction

In the query builder, set a text field condition to value test\ OR Name != NULL --. The generated SOQL will contain WHERE Field = test\ OR Name != NULL -- which Salesforce parses as Field = test OR Name != NULL, returning all records instead of filtering.

Suggested Fix

Escape backslashes before escaping quotes: return s.replace(/\/g, \\).replace(//g, "\");. Alternatively, use parameterized queries where the Salesforce API supports them.

Verification

REFUTED(high): Verified escapeSoqlString at src/ui/utils/soqlBuilder.ts:221-223 only escapes single quotes. In Sale | REAL(high): Verified end-to-end exploitability: (1) escapeSoqlString at src/ui/utils/soqlBuilder.ts:221-223 only | REAL(high): Confirmed via code tracing: escapeSoqlString (lines 221-223) only escapes single quotes, not backsla

🤖 Found by automated codebase audit (Claude Fable 5.1)
@