Merge pull request #597 from AikidoSec/report-sql-dialect

Report SQL dialect in event metadata

Author: hansott

library/agent/context/markUnsafe.test.ts

@@ -66,6 +66,7 @@ t.test("it works", async () => {
       source: "markUnsafe",
       metadata: {
         sql: 'SELECT * FROM "users" WHERE id = 1',
+        dialect: "PostgreSQL",
       },
       payload: "id = 1",
       pathsToPayload: [".[0]"],
@@ -94,6 +95,7 @@ t.test("it works", async () => {
       source: "markUnsafe",
       metadata: {
         sql: 'SELECT * FROM "users" WHERE id = 1',
+        dialect: "PostgreSQL",
       },
       payload: "id = 1",
       pathsToPayload: [".[0].somePropertyThatContainsSQL"],

library/vulnerabilities/sql-injection/checkContextForSqlInjection.test.ts

@@ -30,6 +30,7 @@ t.test("it returns correct path", async () => {
       pathsToPayload: [".id"],
       metadata: {
         sql: "SELECT * FROM users WHERE id = '1' OR 1=1; -- '",
+        dialect: "MySQL",
       },
       payload: "1' OR 1=1; --",
     }

library/vulnerabilities/sql-injection/checkContextForSqlInjection.ts

@@ -36,6 +36,7 @@ export function checkContextForSqlInjection({
           pathsToPayload: getPathsToPayload(str, context[source]),
           metadata: {
             sql: sql,
+            dialect: dialect.getHumanReadableName(),
           },
           payload: str,
         };

library/vulnerabilities/sql-injection/detectSQLInjection.test.ts

@@ -361,3 +361,11 @@ function isNotSqlInjection(
     );
   }
 }
+
+t.test("get human readable name", async () => {
+  t.same(new SQLDialectGeneric().getHumanReadableName(), "Generic");
+  t.same(new SQLDialectMySQL().getHumanReadableName(), "MySQL");
+  t.same(new SQLDialectPostgres().getHumanReadableName(), "PostgreSQL");
+  t.same(new SQLDialectSQLite().getHumanReadableName(), "SQLite");
+  t.same(new SQLDialectClickHouse().getHumanReadableName(), "ClickHouse");
+});

library/vulnerabilities/sql-injection/dialects/SQLDialect.ts

@@ -1,3 +1,4 @@
 export interface SQLDialect {
   getWASMDialectInt(): number;
+  getHumanReadableName(): string;
 }

library/vulnerabilities/sql-injection/dialects/SQLDialectClickHouse.ts

@@ -4,4 +4,7 @@ export class SQLDialectClickHouse implements SQLDialect {
   getWASMDialectInt(): number {
     return 3;
   }
+  getHumanReadableName(): string {
+    return "ClickHouse";
+  }
 }

library/vulnerabilities/sql-injection/dialects/SQLDialectGeneric.ts

@@ -4,4 +4,7 @@ export class SQLDialectGeneric implements SQLDialect {
   getWASMDialectInt(): number {
     return 0;
   }
+  getHumanReadableName(): string {
+    return "Generic";
+  }
 }

library/vulnerabilities/sql-injection/dialects/SQLDialectMySQL.ts

@@ -4,4 +4,7 @@ export class SQLDialectMySQL implements SQLDialect {
   getWASMDialectInt(): number {
     return 8;
   }
+  getHumanReadableName(): string {
+    return "MySQL";
+  }
 }

library/vulnerabilities/sql-injection/dialects/SQLDialectPostgres.ts

@@ -4,4 +4,7 @@ export class SQLDialectPostgres implements SQLDialect {
   getWASMDialectInt(): number {
     return 9;
   }
+  getHumanReadableName(): string {
+    return "PostgreSQL";
+  }
 }

library/vulnerabilities/sql-injection/dialects/SQLDialectSQLite.ts

@@ -4,4 +4,7 @@ export class SQLDialectSQLite implements SQLDialect {
   getWASMDialectInt(): number {
     return 12;
   }
+  getHumanReadableName(): string {
+    return "SQLite";
+  }
 }