AGENTFORCE-25.1: Dynamic SOQL Injection
🚨 Critical · Injection
Detects Apex Database.query calls built via string concatenation or unbound variables, enabling SOQL injection (OWASP A03 / Salesforce SOQL Injection).
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-25.1 |
| Severity | Critical |
| Category | Injection |
| Compliance | EU_AI_ACT_HIGH_RISK, SOC2_CC7 |
Remediation
Validate every dynamic field or clause fragment against an allowlist built from sObjectType.getDescribe().fields.getMap(), reject unknown names, and run the query with AccessLevel.USER_MODE (or WITH USER_MODE) so FLS applies. Pass values as bind variables.