PS: Add query test for the new SQL injection query.

Author: MathiasVP

powershell/ql/test/query-tests/security/cwe-089/SqlInjection.expected

@@ -0,0 +1,17 @@
+edges
+| test.ps1:1:14:1:45 | Call to read-host | test.ps1:5:72:5:77 | query | provenance | Src:MaD:11464  |
+| test.ps1:1:14:1:45 | Call to read-host | test.ps1:9:72:9:77 | query | provenance | Src:MaD:11464  |
+| test.ps1:1:14:1:45 | Call to read-host | test.ps1:17:24:17:76 | SELECT * FROM MyTable WHERE MyColumn = '$userinput' | provenance | Src:MaD:11464  |
+| test.ps1:1:14:1:45 | Call to read-host | test.ps1:28:24:28:76 | SELECT * FROM MyTable WHERE MyColumn = '$userinput' | provenance | Src:MaD:11464  |
+nodes
+| test.ps1:1:14:1:45 | Call to read-host | semmle.label | Call to read-host |
+| test.ps1:5:72:5:77 | query | semmle.label | query |
+| test.ps1:9:72:9:77 | query | semmle.label | query |
+| test.ps1:17:24:17:76 | SELECT * FROM MyTable WHERE MyColumn = '$userinput' | semmle.label | SELECT * FROM MyTable WHERE MyColumn = '$userinput' |
+| test.ps1:28:24:28:76 | SELECT * FROM MyTable WHERE MyColumn = '$userinput' | semmle.label | SELECT * FROM MyTable WHERE MyColumn = '$userinput' |
+subpaths
+#select
+| test.ps1:5:72:5:77 | query | test.ps1:1:14:1:45 | Call to read-host | test.ps1:5:72:5:77 | query | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | user-provided value |
+| test.ps1:9:72:9:77 | query | test.ps1:1:14:1:45 | Call to read-host | test.ps1:9:72:9:77 | query | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | user-provided value |
+| test.ps1:17:24:17:76 | SELECT * FROM MyTable WHERE MyColumn = '$userinput' | test.ps1:1:14:1:45 | Call to read-host | test.ps1:17:24:17:76 | SELECT * FROM MyTable WHERE MyColumn = '$userinput' | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | user-provided value |
+| test.ps1:28:24:28:76 | SELECT * FROM MyTable WHERE MyColumn = '$userinput' | test.ps1:1:14:1:45 | Call to read-host | test.ps1:28:24:28:76 | SELECT * FROM MyTable WHERE MyColumn = '$userinput' | This SQL query depends on a $@. | test.ps1:1:14:1:45 | Call to read-host | user-provided value |

powershell/ql/test/query-tests/security/cwe-089/SqlInjection.qlref

@@ -0,0 +1 @@
+queries/security/cwe-089/SqlInjection.ql

powershell/ql/test/query-tests/security/cwe-089/test.ps1

@@ -0,0 +1,56 @@
+$userinput = Read-Host "Please enter a value"
+
+# Example using Invoke-Sqlcmd with string interpolation
+$query = "SELECT * FROM MyTable WHERE MyColumn = '$userinput'"
+Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query # BAD
+
+# Example using Invoke-Sqlcmd with string concatenation
+$query = "SELECT * FROM MyTable WHERE " + $userinput
+Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query # BAD
+
+#Example using System.Data.SqlClient
+$connection = New-Object System.Data.SqlClient.SqlConnection
+$connection.ConnectionString = "Server=MyServer;Database=MyDatabase;"
+$connection.Open()
+
+$command = $connection.CreateCommand()
+$command.CommandText = "SELECT * FROM MyTable WHERE MyColumn = '$userinput'" # BAD
+$reader = $command.ExecuteReader()
+$reader.Close()
+$connection.Close()
+
+# Example using System.Data.OleDb
+$connection = New-Object System.Data.OleDb.OleDbConnection
+$connection.ConnectionString = "Provider=SQLOLEDB;Data Source=MyServer;Initial Catalog=MyDatabase;"
+$connection.Open()
+
+$command = $connection.CreateCommand()
+$command.CommandText = "SELECT * FROM MyTable WHERE MyColumn = '$userinput'" # BAD
+$reader = $command.ExecuteReader()
+$reader.Close()
+$connection.Close()
+
+# Example using System.Data.SqlClient with parameters
+$connection = New-Object System.Data.SqlClient.SqlConnection
+$connection.ConnectionString = "Server=MyServer;Database=MyDatabase;"
+$connection.Open()
+
+$command = $connection.CreateCommand()
+$command.CommandText = "SELECT * FROM MyTable WHERE MyColumn = @userinput"
+$parameter = $command.Parameters.Add("@userinput", [System.Data.SqlDbType]::NVarChar)
+$parameter.Value = $userinput # GOOD
+$reader = $command.ExecuteReader()
+$reader.Close()
+$connection.Close()
+
+# Example using System.Data.OleDb with parameters
+$connection = New-Object System.Data.OleDb.OleDbConnection
+$connection.ConnectionString = "Provider=SQLOLEDB;Data Source=MyServer;Initial Catalog=MyDatabase;" 
+$connection.Open()
+$command = $connection.CreateCommand()
+$command.CommandText = "SELECT * FROM MyTable WHERE MyColumn = ?"
+$parameter = $command.Parameters.Add("?", [System.Data.OleDb.OleDbType]::VarChar)
+$parameter.Value = $userinput # GOOD
+$reader = $command.ExecuteReader()
+$reader.Close()
+$connection.Close()