detectRegexPatterns checks SQL against compiled regex patterns.
(sql string, patternType PatternType, result *ScanResult)
| 1049 | |
| 1050 | // detectRegexPatterns checks SQL against compiled regex patterns. |
| 1051 | func (s *Scanner) detectRegexPatterns(sql string, patternType PatternType, result *ScanResult) { |
| 1052 | // Ensure patterns are initialized |
| 1053 | compiledPatternsOnce.Do(initCompiledPatterns) |
| 1054 | |
| 1055 | patterns, ok := compiledPatterns[patternType] |
| 1056 | if !ok { |
| 1057 | return |
| 1058 | } |
| 1059 | |
| 1060 | severityMap := map[PatternType]Severity{ |
| 1061 | PatternTautology: SeverityCritical, |
| 1062 | PatternTimeBased: SeverityHigh, |
| 1063 | PatternOutOfBand: SeverityCritical, |
| 1064 | PatternDangerousFunc: SeverityMedium, |
| 1065 | PatternUnionBased: SeverityCritical, |
| 1066 | PatternUnionInjection: SeverityCritical, |
| 1067 | PatternUnionGeneric: SeverityHigh, |
| 1068 | PatternStackedQuery: SeverityCritical, |
| 1069 | } |
| 1070 | |
| 1071 | riskMap := map[PatternType]string{ |
| 1072 | PatternTautology: "Authentication bypass via always-true condition", |
| 1073 | PatternTimeBased: "Time-based blind SQL injection", |
| 1074 | PatternOutOfBand: "Out-of-band data exfiltration or command execution", |
| 1075 | PatternDangerousFunc: "Dynamic SQL execution vulnerability", |
| 1076 | PatternUnionBased: "UNION-based SQL injection for data extraction", |
| 1077 | PatternUnionInjection: "UNION-based SQL injection with injection fingerprint (system table or NULL padding)", |
| 1078 | PatternUnionGeneric: "Possible UNION-based data extraction; review for legitimacy", |
| 1079 | PatternStackedQuery: "Stacked query injection with destructive operations", |
| 1080 | } |
| 1081 | |
| 1082 | suggestionMap := map[PatternType]string{ |
| 1083 | PatternTautology: "Use parameterized queries to prevent tautology injection", |
| 1084 | PatternTimeBased: "Review and sanitize SQL input", |
| 1085 | PatternOutOfBand: "Review and sanitize SQL input", |
| 1086 | PatternDangerousFunc: "Review and sanitize SQL input", |
| 1087 | PatternUnionBased: "Use parameterized queries and validate input", |
| 1088 | PatternUnionInjection: "Use parameterized queries and block system table access", |
| 1089 | PatternUnionGeneric: "Verify UNION is intentional and all inputs are parameterized", |
| 1090 | PatternStackedQuery: "Block semicolons in user input or use parameterized queries", |
| 1091 | } |
| 1092 | |
| 1093 | severity := severityMap[patternType] |
| 1094 | risk := riskMap[patternType] |
| 1095 | suggestion := suggestionMap[patternType] |
| 1096 | |
| 1097 | for _, re := range patterns { |
| 1098 | if matches := re.FindStringSubmatch(sql); len(matches) > 0 { |
| 1099 | finding := Finding{ |
| 1100 | Severity: severity, |
| 1101 | Pattern: patternType, |
| 1102 | Description: "Pattern detected: " + matches[0], |
| 1103 | Risk: risk, |
| 1104 | Suggestion: suggestion, |
| 1105 | } |
| 1106 | if s.shouldInclude(finding.Severity) { |
| 1107 | result.Findings = append(result.Findings, finding) |
| 1108 | } |