fix(942390): move to regex-assembly#4011
Conversation
|
📊 Quantitative test results for language: |
7daba3b to
6309c3a
Compare
|
Test 2 is failing because of encoding :/ |
Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>
Co-authored-by: Max Leske <250711+theseion@users.noreply.github.com>
Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>
There was a problem hiding this comment.
Pull request overview
This PR refactors rule 942390 to use the regex-assembly format for better maintainability and documentation. The rule detects SQL injection attacks using OR and XOR logical operators.
Changes:
- Migrated rule 942390 from inline regex to regex-assembly format with comprehensive documentation and examples
- Updated error message to be more specific: "SQL Injection Attack using (X)OR"
- Added 6 new test cases covering various OR/XOR injection patterns
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| regex-assembly/942390.ra | New regex-assembly source file with documented patterns, variable definitions, and examples for detecting OR/XOR-based SQL injection |
| rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf | Updated compiled regex and improved error message to specify (X)OR attacks |
| tests/regression/tests/REQUEST-942-APPLICATION-ATTACK-SQLI/942390.yaml | Enhanced test 1 description and added 6 new test cases covering different OR/XOR attack variations |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
for more information, see https://pre-commit.ci
Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>
|
|
||
| ##!> define x_or \bx?or\b | ||
| ##!> define quotes [\'\"] | ||
| ##!> define spaces \s+ |
There was a problem hiding this comment.
This isn't quite the same as before, where some expressions used \s?, e.g., ...or1= could probably be parsed.
There was a problem hiding this comment.
\bor\b\s?[0-9] never matches or1= because \b after r requires a non-word character next, and digits are word characters. So or1= is a blind spot in both the original and the PR. The \s? was always effectively \s.
what
why
references