Code

Use zen_internals sql tokenizer#213

Code

Merged

willem-delbare merged 42 commits intomainAikidoSec/firewall-python:mainfrom update-sql-injection-algo-to-tokenizerAikidoSec/firewall-python:update-sql-injection-algo-to-tokenizerCopy head branch name to clipboardNov 26, 2024

+343-781

Commits

Commits on Sep 24, 2024

• Update __init__.py and remove old sql injection algo

  

  Wout Feys

  committed
  a4bbddc

• It's only up until 1 char user input

  

  Wout Feys

  committed
  800a0ad

• Better integer test using regex in sql_injection algo

  

  Wout Feys

  committed
  14d82b4

Commits on Sep 25, 2024

• Bugfix for should_return_early sql inj : .contains => in

  

  Wout Feys

  committed
  97002ff

• Add unit tests for should_return_early in sql_injection algo

  

  Wout Feys

  committed
  5b14d89

• Update good and bad sql commands to remove mails, invalid sql and "are"

  

  Wout Feys

  committed
  3144aca

• Move union i snot union test to IS_NOT_INJECTION

  

  Wout Feys

  committed
  6d7de6b

• Remove parameterization of "dangerous chars"

  

  Wout Feys

  committed
  76320ea

• foobar) foobar ) and eurofoobar are all examples of sql injections

  

  Wout Feys

  committed
  4dd66f7

• '123' as userinput should not be marked as an injection

  

  Wout Feys

  committed
  5297560

• Bugfix : Lower query and user input on python side before sending to rust

  

  Wout Feys

  committed
  8ade460

• Remove dialects and interchange them with an integer map

  

  Wout Feys

  committed
  40f966a

• Fix test_allow_escape_sequences by setting to not sql injection

  

  Wout Feys

  committed
  88d7696

• Change what is "invalid query" and what is not

  

  Wout Feys

  committed
  b2c650e

• Fix safely escaped test with backtick

  

  Wout Feys

  committed
  aa0183e

Commits on Sep 26, 2024

• Allow for alphanumerical input with dashes

  

  Wout Feys

  committed
  28bbcd5

• Used wrong naming, dashes when in fact referring to underscores

  

  Wout Feys

  committed
  14821e0

• Move keyword-only queries to "bad queries"

  

  Wout Feys

  committed
  2df772c

Commits on Sep 27, 2024

• Only lowercase query and userinput once

  

  Wout Feys

  committed
  61a0383

• Update makefile to auto download zen library with install and build

  

  Wout Feys

  committed
  ba58135

• Use the new folder/naming of the lib.so file in sql injection

  

  Wout Feys

  committed
  bfdb293

• Update all github workflows to use make commands for install

  

  Wout Feys

  committed
  4c71136

• Remove dialects from sink tests

  

  Wout Feys

  committed
  0335ade

• Allow aikido_zen/lib/*.so to be included in project, use for download

  

  Wout Feys

  committed
  6830d47

• Add comments explaining the reasoning behind removing/altering tests

  

  Wout Feys

  committed
  3085616

• Add comments explaining why we removed the e-mail tests

  

  Wout Feys

  committed
  a600ee0

Commits on Sep 30, 2024

• Add comm'ents test back in as "Mysql" specific

  

  Wout Feys

  committed
  07d28c6

• Allow dialects in is_sql_injection and is_not_sql_injection

  

  Wout Feys

  committed
  3b1909f

• Add mysql specific tests and tests back in for backticks

  

  Wout Feys

  committed
  87dde9a

• Also test escaped strings from dangerous strs as not injection

  

  Wout Feys

  committed
  dedc404

Commits on Oct 1, 2024

• Add comments for given query and add positive counter-examples

  

  Wout Feys

  committed
  042a71e

Commits on Oct 23, 2024

• Return false if return integer is 2

  Show description for 97433b6
  hansott

  committed
  97433b6

• Use logger.debug

  hansott

  authored
  00fbb56

Commits on Nov 26, 2024

• Merge branch 'main' into update-sql-injection-algo-to-tokenizer

  

  Wout Feys

  committed
  cbf04e3

• Linting

  

  Wout Feys

  committed
  c12a0b2

• Download all rust binaries

  

  Wout Feys

  committed
  bac09da

• Try-except and use get_lib_path

  

  Wout Feys

  committed
  6329071

• Fix makefile

  

  Wout Feys

  committed
  f197586

• Fix a broken unit test that has a dialect import

  

  Wout Feys

  committed
  af057c8

• Bump zen_internals v0.1.26 --> v0.1.31

  

  Wout Feys

  committed
  b4b911d

• Get the library after early return in sql_injeciton algorithm

  

  Wout Feys

  committed
  b00e0fe

• Update Makefile

  Show description for 941b377
  

  bitterpanda63

  and

  hansott

  authored
  941b377