detectCommentPatterns checks raw SQL for comment-based injection.
(sql string, result *ScanResult)
| 994 | |
| 995 | // detectCommentPatterns checks raw SQL for comment-based injection. |
| 996 | func (s *Scanner) detectCommentPatterns(sql string, result *ScanResult) { |
| 997 | // Ensure patterns are initialized |
| 998 | commentPatternsOnce.Do(initCommentPatterns) |
| 999 | |
| 1000 | for _, p := range commentPatterns { |
| 1001 | if safeRegexMatch(p.re, sql) { |
| 1002 | finding := Finding{ |
| 1003 | Severity: p.severity, |
| 1004 | Pattern: PatternComment, |
| 1005 | Description: p.description, |
| 1006 | Risk: "SQL injection via comment-based bypass", |
| 1007 | Suggestion: "Sanitize input to remove SQL comments", |
| 1008 | } |
| 1009 | if s.shouldInclude(finding.Severity) { |
| 1010 | result.Findings = append(result.Findings, finding) |
| 1011 | } |
| 1012 | } |
| 1013 | } |
| 1014 | } |
| 1015 | |
| 1016 | // detectTautologyInSQL checks raw SQL for tautology patterns (e.g. OR 1=1, 'a'='a'). |
| 1017 | // Because Go's RE2 engine does not support backreferences, equality of the two sides |
no test coverage detected