-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #74 from AikidoSec/patch-move
Move functions to separate files
- Loading branch information
Showing
8 changed files
with
88 additions
and
90 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
36 changes: 36 additions & 0 deletions
36
library/src/vulnerabilities/sql-injection/checkContextForSqlInjection.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| import { Context } from "../../agent/Context"; | ||
| import { InterceptorResult } from "../../agent/hooks/MethodInterceptor"; | ||
| import { Source } from "../../agent/Source"; | ||
| import { extractStringsFromUserInput } from "../../helpers/extractStringsFromUserInput"; | ||
| import { detectSQLInjection } from "./detectSQLInjection"; | ||
|
|
||
| /** | ||
| * This function goes over all the different input types in the context and checks | ||
| * if it's a possible SQL Injection, if so the function returns an InterceptorResult | ||
| */ | ||
| export function checkContextForSqlInjection({ | ||
| sql, | ||
| operation, | ||
| context, | ||
| }: { | ||
| sql: string; | ||
| operation: string; | ||
| context: Context; | ||
| }): InterceptorResult { | ||
| for (const source of ["body", "query", "headers", "cookies"] as Source[]) { | ||
| if (context[source]) { | ||
| const userInput = extractStringsFromUserInput(context[source]); | ||
| for (const str of userInput) { | ||
| if (detectSQLInjection(sql, str)) { | ||
| return { | ||
| operation: operation, | ||
| kind: "sql_injection", | ||
| source: source, | ||
| pathToPayload: "UNKOWN", | ||
| metadata: {}, | ||
| }; | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } |
9 changes: 3 additions & 6 deletions
9
library/src/vulnerabilities/sql-injection/detectSQLInjection.test.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
13 changes: 13 additions & 0 deletions
13
library/src/vulnerabilities/sql-injection/queryContainsUserInput.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| /** | ||
| * This function is the first step to determine if an SQL Injection is happening, | ||
| * If the sql statement contains user input, this function returns true (case-insensitive) | ||
| * @param query The SQL Statement you want to check it against | ||
| * @param userInput The user input you want to check | ||
| * @returns True when the sql statement contains the input | ||
| */ | ||
| export function queryContainsUserInput(query: string, userInput: string) { | ||
| const lowercaseSql = query.toLowerCase(); | ||
| const lowercaseInput = userInput.toLowerCase(); | ||
|
|
||
| return lowercaseSql.includes(lowercaseInput); | ||
| } |
31 changes: 31 additions & 0 deletions
31
library/src/vulnerabilities/sql-injection/userInputOccurrencesSafelyEncapsulated.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| import { SQL_STRING_CHARS } from "./config"; | ||
|
|
||
| /** | ||
| * This function is the third step to determine if an SQL Injection is happening, | ||
| * This checks if **all** occurrences of our input are encapsulated as strings. | ||
| * @param query The SQL Statement | ||
| * @param userInput The user input you want to check is encapsulated | ||
| * @returns True if the input is always encapsulated inside a string | ||
| */ | ||
| export function userInputOccurrencesSafelyEncapsulated( | ||
| query: string, | ||
| userInput: string | ||
| ) { | ||
| const queryWithoutUserInput = query.split(userInput); | ||
| for (let i = 0; i + 1 < queryWithoutUserInput.length; i++) { | ||
| // Get the last character of this segment | ||
| const lastChar = queryWithoutUserInput[i].slice(-1); | ||
| // Get the first character of the next segment | ||
| const firstCharNext = queryWithoutUserInput[i + 1].slice(0, 1); | ||
|
|
||
| if (!SQL_STRING_CHARS.includes(lastChar)) { | ||
| return false; // If the character is not one of these, it's not a string. | ||
| } | ||
|
|
||
| if (lastChar != firstCharNext) { | ||
| return false; // String is not encapsulated by the same type of quotes. | ||
| } | ||
| } | ||
|
|
||
| return true; | ||
| } |