Skip to content

fix(detectors): Fix bug with empty string and keyword in SQL Injection Detector #93071

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: master
Choose a base branch
from

Conversation

roggenkemper
Copy link
Member

@roggenkemper roggenkemper commented Jun 6, 2025

adds a few additional checks to the sql injection detector:

  1. adds a check for an empty string
  2. checks if the key is a SQL keyword, now that we are checking if the key is also in the description.
  3. checks if the value is 1 character - can cause false positives if it's a single letter or number

@github-actions github-actions bot added the Scope: Backend Automatically applied to PRs that change backend components label Jun 6, 2025
@roggenkemper roggenkemper changed the title fix(detectors): Fix bug with empty string in SQL Injection Detector fix(detectors): Fix bug with empty string and keyword in SQL Injection Detector Jun 6, 2025
@roggenkemper roggenkemper marked this pull request as ready for review June 6, 2025 22:05
@roggenkemper roggenkemper requested review from a team as code owners June 6, 2025 22:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Scope: Backend Automatically applied to PRs that change backend components
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant