48 lines
1.7 KiB
JavaScript
48 lines
1.7 KiB
JavaScript
/**
|
|
* SQL-STRICT context patterns.
|
|
*
|
|
* Extends the base 'SQL' context with three additional rules that are
|
|
* effective at detecting real injections but carry a higher false-positive
|
|
* risk on general free-text input.
|
|
*
|
|
* Use 'SQL-STRICT' when:
|
|
* - The string is specifically a SQL fragment or database identifier
|
|
* - You control the input domain (e.g. a dedicated SQL search field)
|
|
* - You can tolerate occasional false positives in exchange for broader coverage
|
|
*
|
|
* Use 'SQL' (not STRICT) when:
|
|
* - The field is general user text (names, descriptions, comments)
|
|
* - False positives would block legitimate content (e.g. "see note -- above")
|
|
*
|
|
* Rules moved here from 'SQL' due to false-positive risk:
|
|
*
|
|
* sql-line-comment — "--" fires on "see note -- above", "value--", CSS var(--primary)
|
|
* sql-stacked-query — "; SELECT" fires on legitimate prose with semicolons + SQL words
|
|
* sql-hex-encoding — "0xDEAD" fires on hex values in technical docs and log output
|
|
*/
|
|
|
|
import SQL_PATTERNS from './sql.js';
|
|
|
|
const SQL_STRICT_EXTRA = [
|
|
{
|
|
id: 'sql-line-comment',
|
|
description: 'SQL line comment: -- followed by whitespace or end of string',
|
|
pattern: /--(?:\s|$)/,
|
|
},
|
|
{
|
|
id: 'sql-stacked-query',
|
|
description: 'Stacked queries: semicolon immediately followed by a SQL keyword',
|
|
pattern: /;\s{0,10}(?:SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC)\b/i,
|
|
},
|
|
{
|
|
id: 'sql-hex-encoding',
|
|
description: 'Hex-encoded string injection: 0x41414141 style (MySQL)',
|
|
pattern: /\b0x[0-9a-f]{4,}/i,
|
|
},
|
|
];
|
|
|
|
// SQL-STRICT = all base SQL rules + the three noisy extras
|
|
const SQL_STRICT_PATTERNS = [...SQL_PATTERNS, ...SQL_STRICT_EXTRA];
|
|
|
|
export default SQL_STRICT_PATTERNS;
|