Function TestScanSQL_UnionInjection

pkg/sql/security/scanner_test.go:668–715

Test UNION-based injection detection (Issue #170)

(t *testing.T)

// Test UNION-based injection detection (Issue #170)
func TestScanSQL_UnionInjection(t *testing.T) {
	scanner := NewScanner()

	testCases := []struct {
		sql          string
		shouldDetect bool
		description  string
	}{
		{
			sql:          "SELECT * FROM users WHERE id = 1 UNION SELECT password FROM admins",
			shouldDetect: true,
			description:  "Basic UNION SELECT injection",
		},
		{
			sql:          "SELECT id FROM users UNION ALL SELECT username FROM admins",
			shouldDetect: true,
			description:  "UNION ALL SELECT injection",
		},
		{
			sql:          "SELECT * FROM users WHERE id = 1 UNION SELECT table_name FROM information_schema.tables",
			shouldDetect: true,
			description:  "UNION with information_schema access",
		},
		{
			sql:          "SELECT * FROM active_users UNION SELECT * FROM archived_users",
			shouldDetect: true,
			description:  "Legitimate UNION (will be flagged but needs review)",
		},
	}

	for _, tc := range testCases {
		t.Run(tc.description, func(t *testing.T) {
			result := scanner.ScanSQL(tc.sql)
			hasUnionPattern := false
			for _, f := range result.Findings {
				// ScanSQL now emits PatternUnionInjection (CRITICAL) or PatternUnionGeneric (HIGH)
				if f.Pattern == PatternUnionInjection || f.Pattern == PatternUnionGeneric {
					hasUnionPattern = true
					break
				}
			}

			if tc.shouldDetect && !hasUnionPattern {
				t.Errorf("expected UNION pattern in: %s", tc.description)
			}
		})
	}
}

// Test stacked query injection detection (Issue #170)
func TestScanSQL_StackedQueryInjection(t *testing.T) {