Python: Go Interface based Checker for SQL injection vulnerability #119
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎ 1 Skipped Deployment
|
Contributor
|
Hey, could you please add test directives to the test files. |
Author
|
Sure, I'll get back to that this evening! Thanks |
Author
|
@MashyBasker Added! |
Signed-off-by: Sourya Vatsyayan <sourya@deepsource.io>
sourya-deepsource
force-pushed
the
sql-injection-py-checker
branch
from
6e24cec to
c57caa6
Compare
Signed-off-by: Vivek Anand <78247712+viveka1302@users.noreply.github.com>
Signed-off-by: Vivek Anand <78247712+viveka1302@users.noreply.github.com>
Contributor
|
This is being done in a different way (using scope analysis and data flow) here. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
GoLang was chosen for this checker for complex logical control of flow of execution.
Basic Idea:
SQL injection vulnerability in this checker is assumed when a SQL query contains concatenated string (f-string or interpolation) with user-input instead of parameterisation.
Logic:
To identify an SQL execution call, we search for the most common execution calls across all SQL libraries and ORMs, like:
execute, executemany, executescript
Once we find such a call, the first case we check for, is if the developer has passed a string directly to the execution call, in which case, a normal tree-sitter-query is enough.
If instead, we find a variable passed as parameter, instead of raw string, we use Go to trace the variable back to it's origin, whether it's in the same file or in a different file in the same project (hence, accounting for multiple layers of variables being passed in one another).
Once spotted, we check the assigned value for any concatenated strings. If found, the user receives Report.
Type Of Change
Checklist: