Method checkUnionInjection

pkg/sql/security/scanner.go:851–894

checkUnionInjection analyzes UNION for potential data extraction.

(stmt *ast.SetOperation, result *ScanResult)

// checkUnionInjection analyzes UNION for potential data extraction.
func (s *Scanner) checkUnionInjection(stmt *ast.SetOperation, result *ScanResult) {
	// Check if right side SELECT has suspicious patterns
	if rightSelect, ok := stmt.Right.(*ast.SelectStatement); ok {
		// Check for NULL placeholders (common in UNION injection)
		nullCount := 0
		for _, col := range rightSelect.Columns {
			if ident, ok := col.(*ast.Identifier); ok {
				if strings.ToUpper(ident.Name) == "NULL" {
					nullCount++
				}
			}
		}

		// Multiple NULLs in UNION SELECT is suspicious
		if nullCount >= 2 {
			finding := Finding{
				Severity:    SeverityHigh,
				Pattern:     PatternUnionBased,
				Description: "UNION SELECT with multiple NULL columns detected",
				Risk:        "Data extraction via UNION-based injection",
				Suggestion:  "Verify UNION is intentional and inputs are sanitized",
			}
			if s.shouldInclude(finding.Severity) {
				result.Findings = append(result.Findings, finding)
			}
		}

		// Check for system table access using precise matching
		if rightSelect.TableName != "" {
			if s.isSystemTable(rightSelect.TableName) {
				finding := Finding{
					Severity:    SeverityCritical,
					Pattern:     PatternUnionBased,
					Description: "UNION SELECT accessing system tables detected",
					Risk:        "Database schema enumeration, privilege escalation",
					Suggestion:  "Block access to system tables from user queries",
				}
				if s.shouldInclude(finding.Severity) {
					result.Findings = append(result.Findings, finding)
				}
			}
		}
	}
}

// isSystemTable checks if a table name refers to a system table using precise matching.
// Uses prefix matching and exact name matching to avoid false positives.