Method scanFunctionCall

pkg/sql/security/scanner.go:919–976

scanFunctionCall checks for dangerous function usage.

(fn *ast.FunctionCall, result *ScanResult)

// scanFunctionCall checks for dangerous function usage.
func (s *Scanner) scanFunctionCall(fn *ast.FunctionCall, result *ScanResult) {
	if fn == nil {
		return
	}

	funcName := strings.ToUpper(fn.Name)

	// Time-based blind injection functions
	timeBasedFuncs := map[string]bool{
		"SLEEP":     true,
		"PG_SLEEP":  true,
		"BENCHMARK": true,
		"WAITFOR":   true,
	}

	if timeBasedFuncs[funcName] {
		finding := Finding{
			Severity:    SeverityHigh,
			Pattern:     PatternTimeBased,
			Description: "Time-based blind injection function detected: " + fn.Name,
			Risk:        "Time-based blind SQL injection, DoS",
			Suggestion:  "Block or restrict time delay functions",
		}
		if s.shouldInclude(finding.Severity) {
			result.Findings = append(result.Findings, finding)
		}
	}

	// Out-of-band / dangerous functions
	dangerousFuncs := map[string]string{
		"LOAD_FILE":     "File system access",
		"LOAD DATA":     "File system access",
		"XP_CMDSHELL":   "Command execution",
		"SP_OACREATE":   "OLE automation",
		"UTL_HTTP":      "Network access",
		"DBMS_LDAP":     "LDAP access",
		"EXEC":          "Dynamic SQL execution",
		"SP_EXECUTESQL": "Dynamic SQL execution",
	}

	if risk, found := dangerousFuncs[funcName]; found {
		finding := Finding{
			Severity:    SeverityCritical,
			Pattern:     PatternOutOfBand,
			Description: "Dangerous function detected: " + fn.Name,
			Risk:        risk,
			Suggestion:  "Block dangerous functions or use allowlist",
		}
		if s.shouldInclude(finding.Severity) {
			result.Findings = append(result.Findings, finding)
		}
	}

	// Recursively check function arguments
	for _, arg := range fn.Arguments {
		s.scanExpressionForDangerousFunctions(arg, result)
	}
}