| 203 | } |
| 204 | |
| 205 | pub async fn parse_query(&self, cursor: &mut Cursor<&[u8]>, length: u32) -> Result<FrontendMessage, ParseError> { |
| 206 | let sql = self.read_cstring_with_length(cursor, length as usize).await?; |
| 207 | |
| 208 | // Security: basic SQL injection detection |
| 209 | let sql_lower = sql.to_lowercase(); |
| 210 | if sql_lower.contains("drop table") || |
| 211 | sql_lower.contains("delete from") || |
| 212 | sql_lower.contains("truncate") || |
| 213 | sql_lower.contains("' or '1'='1") || |
| 214 | sql_lower.contains("union select") { |
| 215 | events::sql_injection_attempt(None, None, &sql, "Suspicious SQL pattern detected"); |
| 216 | } |
| 217 | |
| 218 | Ok(FrontendMessage::Query(sql)) |
| 219 | } |
| 220 | |
| 221 | async fn parse_ssl_request(&self, cursor: &mut Cursor<&[u8]>) -> Result<FrontendMessage, ParseError> { |
| 222 | // SSL request has a specific format: 8 bytes total |