MCPcopy Create free account
hub / github.com/erans/pgsqlite / analyze_expression

Method analyze_expression

src/security/sql_injection_detector.rs:307–353  ·  view source on GitHub ↗
(
        &self,
        expr: &Expr,
        analysis: &mut SqlAnalysisResult,
        depth: usize,
        original_query: &str
    )

Source from the content-addressed store, hash-verified

305 }
306
307 fn analyze_expression(
308 &self,
309 expr: &Expr,
310 analysis: &mut SqlAnalysisResult,
311 depth: usize,
312 original_query: &str
313 ) -> Result<(), PgSqliteError> {
314 match expr {
315 Expr::BinaryOp { left, op, right } => {
316 // Check for tautologies like 1=1, 'a'='a', etc.
317 if self.is_tautology(left, op, right) {
318 analysis.has_tautology = true;
319 }
320
321 self.analyze_expression(left, analysis, depth, original_query)?;
322 self.analyze_expression(right, analysis, depth, original_query)?;
323 }
324 Expr::Function(func) => {
325 let func_name = func.name.to_string().to_lowercase();
326
327 if self.dangerous_functions.contains(&func_name) {
328 analysis.has_dangerous_function = true;
329 }
330
331 // Analyze function arguments
332 if let FunctionArguments::List(function_arg_list) = &func.args {
333 for arg in &function_arg_list.args {
334 if let sqlparser::ast::FunctionArg::Unnamed(sqlparser::ast::FunctionArgExpr::Expr(arg_expr)) = arg {
335 self.analyze_expression(&arg_expr, analysis, depth, original_query)?;
336 }
337 }
338 }
339 }
340 Expr::Subquery(_) | Expr::InSubquery { .. } | Expr::Exists { .. } => {
341 // Skip detailed subquery analysis for now to avoid API compatibility issues
342 // The main query will catch most injection attempts
343 analysis.statement_count += 1;
344 if analysis.statement_count > self.max_statements {
345 analysis.has_modifying_statements = true;
346 }
347 }
348 _ => {
349 // Other expression types
350 }
351 }
352 Ok(())
353 }
354
355 fn analyze_dml_statement(
356 &self,

Callers 3

analyze_select_itemMethod · 0.80
analyze_dml_statementMethod · 0.80

Calls 1

is_tautologyMethod · 0.80

Tested by

no test coverage detected