Method ScanSQL

pkg/sql/security/scanner.go:606–646

ScanSQL analyzes raw SQL string for injection patterns using regex-based detection. This method is useful for detecting patterns that might not be visible in the AST, such as SQL comments, or when you don't have a parsed AST available. The method uses pre-compiled regex patterns to detect: - Commen

(sql string)

//	    }
//	}
func (s *Scanner) ScanSQL(sql string) *ScanResult {
	result := &ScanResult{
		Findings: make([]Finding, 0),
	}

	// Strip dollar-quoted string content to prevent false positives
	sql = stripDollarQuotedStrings(sql)

	// Check for comment-based bypass patterns in raw SQL
	s.detectCommentPatterns(sql, result)

	// Check for tautology patterns (OR 1=1, 'a'='a', etc.)
	// detectRegexPatterns handles the simple OR TRUE pattern; detectTautologyInSQL
	// handles equality-based tautologies using a two-step capture approach (RE2
	// does not support backreferences, so equality is verified programmatically).
	s.detectRegexPatterns(sql, PatternTautology, result)
	s.detectTautologyInSQL(sql, result)

	// Check for time-based patterns
	s.detectRegexPatterns(sql, PatternTimeBased, result)

	// Check for out-of-band patterns
	s.detectRegexPatterns(sql, PatternOutOfBand, result)

	// Check for dangerous function patterns
	s.detectRegexPatterns(sql, PatternDangerousFunc, result)

	// Check for UNION injection fingerprints (CRITICAL: system tables, NULL-padding)
	s.detectRegexPatterns(sql, PatternUnionInjection, result)

	// Check for generic UNION SELECT (HIGH: may be legitimate, but warrants review)
	s.detectRegexPatterns(sql, PatternUnionGeneric, result)

	// Check for stacked query patterns
	s.detectRegexPatterns(sql, PatternStackedQuery, result)

	// Update counts
	s.updateCounts(result)

	return result
}

// scanStatement analyzes a single statement for injection patterns.
func (s *Scanner) scanStatement(stmt ast.Statement, result *ScanResult) {