scanSelectStatement analyzes SELECT for injection patterns.
(stmt *ast.SelectStatement, result *ScanResult)
| 663 | |
| 664 | // scanSelectStatement analyzes SELECT for injection patterns. |
| 665 | func (s *Scanner) scanSelectStatement(stmt *ast.SelectStatement, result *ScanResult) { |
| 666 | // Check WHERE clause for tautologies |
| 667 | if stmt.Where != nil { |
| 668 | s.scanExpression(stmt.Where, result, "WHERE clause") |
| 669 | } |
| 670 | |
| 671 | // Check HAVING clause |
| 672 | if stmt.Having != nil { |
| 673 | s.scanExpression(stmt.Having, result, "HAVING clause") |
| 674 | } |
| 675 | |
| 676 | // Check for suspicious function calls in columns |
| 677 | for _, col := range stmt.Columns { |
| 678 | s.scanExpressionForDangerousFunctions(col, result) |
| 679 | } |
| 680 | } |
| 681 | |
| 682 | // scanInsertStatement analyzes INSERT for injection patterns. |
| 683 | func (s *Scanner) scanInsertStatement(stmt *ast.InsertStatement, result *ScanResult) { |
no test coverage detected