Method fallback_pattern_analysis

src/security/sql_injection_detector.rs:453–494

Fallback pattern-based analysis when SQL parsing fails

(&self, query: &str)

    /// Fallback pattern-based analysis when SQL parsing fails
    fn fallback_pattern_analysis(&self, query: &str) -> Result<SqlAnalysisResult, PgSqliteError> {
        let query_upper = query.to_uppercase();

        // High-confidence injection patterns
        let dangerous_patterns = [
            "'; DROP",
            "\"; DROP",
            "'; DELETE",
            "\"; DELETE",
            "' OR '1'='1",
            "\" OR \"1\"=\"1\"",
            " OR 1=1",
            " OR 1 = 1",
            "UNION SELECT PASSWORD",
            "UNION SELECT * FROM ADMIN",
            "UNION SELECT PASSWORD FROM ADMIN",
            "EXEC(",
            "EXECUTE(",
            "XP_CMDSHELL",
            "SP_EXECUTESQL",
        ];

        for pattern in &dangerous_patterns {
            if query_upper.contains(pattern) {
                events::sql_injection_attempt(None, None, query, pattern);
                return Err(PgSqliteError::InvalidParameter(
                    format!("Malicious pattern detected: {}", pattern)
                ));
            }
        }

        // Check for excessive statements
        let semicolon_count = query.matches(';').count();
        if semicolon_count > self.max_statements {
            events::sql_injection_attempt(None, None, query, "too many statements");
            return Err(PgSqliteError::InvalidParameter(
                format!("Too many statements: {}", semicolon_count)
            ));
        }

        Ok(SqlAnalysisResult::new())
    }
}

/// Result of SQL injection analysis