checkOrInjection checks for OR-based injection patterns.
(expr *ast.BinaryExpression, result *ScanResult)
| 815 | |
| 816 | // checkOrInjection checks for OR-based injection patterns. |
| 817 | func (s *Scanner) checkOrInjection(expr *ast.BinaryExpression, result *ScanResult) { |
| 818 | // Check if the OR condition contains a tautology |
| 819 | if rightBin, ok := expr.Right.(*ast.BinaryExpression); ok { |
| 820 | if s.isTautology(rightBin) { |
| 821 | finding := Finding{ |
| 822 | Severity: SeverityCritical, |
| 823 | Pattern: PatternTautology, |
| 824 | Description: "OR condition with tautology detected (e.g., OR 1=1)", |
| 825 | Risk: "Authentication bypass, unauthorized data access", |
| 826 | Suggestion: "Review and sanitize input parameters", |
| 827 | } |
| 828 | if s.shouldInclude(finding.Severity) { |
| 829 | result.Findings = append(result.Findings, finding) |
| 830 | } |
| 831 | } |
| 832 | } |
| 833 | |
| 834 | if leftBin, ok := expr.Left.(*ast.BinaryExpression); ok { |
| 835 | if s.isTautology(leftBin) { |
| 836 | finding := Finding{ |
| 837 | Severity: SeverityCritical, |
| 838 | Pattern: PatternTautology, |
| 839 | Description: "OR condition with tautology detected", |
| 840 | Risk: "Authentication bypass, unauthorized data access", |
| 841 | Suggestion: "Review and sanitize input parameters", |
| 842 | } |
| 843 | if s.shouldInclude(finding.Severity) { |
| 844 | result.Findings = append(result.Findings, finding) |
| 845 | } |
| 846 | } |
| 847 | } |
| 848 | } |
| 849 | |
| 850 | // checkUnionInjection analyzes UNION for potential data extraction. |
| 851 | func (s *Scanner) checkUnionInjection(stmt *ast.SetOperation, result *ScanResult) { |
no test coverage detected