(
&self,
expr: &Expr,
analysis: &mut SqlAnalysisResult,
depth: usize,
original_query: &str
)
| 305 | } |
| 306 | |
| 307 | fn analyze_expression( |
| 308 | &self, |
| 309 | expr: &Expr, |
| 310 | analysis: &mut SqlAnalysisResult, |
| 311 | depth: usize, |
| 312 | original_query: &str |
| 313 | ) -> Result<(), PgSqliteError> { |
| 314 | match expr { |
| 315 | Expr::BinaryOp { left, op, right } => { |
| 316 | // Check for tautologies like 1=1, 'a'='a', etc. |
| 317 | if self.is_tautology(left, op, right) { |
| 318 | analysis.has_tautology = true; |
| 319 | } |
| 320 | |
| 321 | self.analyze_expression(left, analysis, depth, original_query)?; |
| 322 | self.analyze_expression(right, analysis, depth, original_query)?; |
| 323 | } |
| 324 | Expr::Function(func) => { |
| 325 | let func_name = func.name.to_string().to_lowercase(); |
| 326 | |
| 327 | if self.dangerous_functions.contains(&func_name) { |
| 328 | analysis.has_dangerous_function = true; |
| 329 | } |
| 330 | |
| 331 | // Analyze function arguments |
| 332 | if let FunctionArguments::List(function_arg_list) = &func.args { |
| 333 | for arg in &function_arg_list.args { |
| 334 | if let sqlparser::ast::FunctionArg::Unnamed(sqlparser::ast::FunctionArgExpr::Expr(arg_expr)) = arg { |
| 335 | self.analyze_expression(&arg_expr, analysis, depth, original_query)?; |
| 336 | } |
| 337 | } |
| 338 | } |
| 339 | } |
| 340 | Expr::Subquery(_) | Expr::InSubquery { .. } | Expr::Exists { .. } => { |
| 341 | // Skip detailed subquery analysis for now to avoid API compatibility issues |
| 342 | // The main query will catch most injection attempts |
| 343 | analysis.statement_count += 1; |
| 344 | if analysis.statement_count > self.max_statements { |
| 345 | analysis.has_modifying_statements = true; |
| 346 | } |
| 347 | } |
| 348 | _ => { |
| 349 | // Other expression types |
| 350 | } |
| 351 | } |
| 352 | Ok(()) |
| 353 | } |
| 354 | |
| 355 | fn analyze_dml_statement( |
| 356 | &self, |
no test coverage detected