Function DetectSQLInjection

internal/waf/injectionutils/utils_sqli.go:52–93

DetectSQLInjection detect sql injection in string

(input string, isStrict bool)

// DetectSQLInjection detect sql injection in string
func DetectSQLInjection(input string, isStrict bool) bool {
	if len(input) == 0 {
		return false
	}

	if !isStrict {
		if len(input) > 1024 {
			if !utf8.ValidString(input[:1024]) && !utf8.ValidString(input[:1023]) && !utf8.ValidString(input[:1022]) {
				return false
			}
		} else {
			if !utf8.ValidString(input) {
				return false
			}
		}
	}

	if detectSQLInjectionOne(input) {
		return true
	}

	// 兼容 /PATH?URI
	if (input[0] == '/' || strings.HasPrefix(input, "http://") || strings.HasPrefix(input, "https://")) && len(input) < 1024 {
		var argsIndex = strings.Index(input, "?")
		if argsIndex > 0 {
			var args = input[argsIndex+1:]
			unescapeArgs, err := url.QueryUnescape(args)
			if err == nil && args != unescapeArgs {
				return detectSQLInjectionOne(args) || detectSQLInjectionOne(unescapeArgs)
			} else {
				return detectSQLInjectionOne(args)
			}
		}
	} else {
		unescapedInput, err := url.QueryUnescape(input)
		if err == nil && input != unescapedInput {
			return detectSQLInjectionOne(unescapedInput)
		}
	}

	return false
}

func detectSQLInjectionOne(input string) bool {
	if len(input) == 0 {