Code

SQL injection detection#12

Code

Merged

CaspianA1 merged 87 commits intomaindbos-inc/eslint-plugin:mainfrom CaspianA1/sql_injection_detectiondbos-inc/eslint-plugin:CaspianA1/sql_injection_detectionCopy head branch name to clipboardJul 25, 2024

+1,577-463

Commits

Commits on Jul 8, 2024

• A couple of things:

  Show description for 801ae02
  CaspianA1

  committed
  801ae02

  Copy full SHA for 801ae02

• Make the README a bit more correct

  CaspianA1

  committed
  4400836

  Copy full SHA for 4400836

• Fix 'checkSqlInjectionDecorators'. Set up a test for SQL injection detection. Flesh another function out slightly more.

  CaspianA1

  committed
  0f64fdc

  Copy full SHA for 0f64fdc

• Flesh out more of the SQL injection detection logic

  CaspianA1

  committed
  d2f66e8

  Copy full SHA for d2f66e8

• Make a comment more correct

  CaspianA1

  committed
  1f5686c

  Copy full SHA for 1f5686c

Commits on Jul 9, 2024

• Word some tests better. Start on the SQL injection code (just two cases, and for Knex).

  CaspianA1

  committed
  c319be0

  Copy full SHA for c319be0

• Change some return styles (it was annoying to read otherwise)

  CaspianA1

  committed
  00ca063

  Copy full SHA for 00ca063

• Move some core util functions

  CaspianA1

  committed
  5dd6f4a

  Copy full SHA for 5dd6f4a

• Now ignoring dbos-demo-apps from local e2e tests in the gitignore and with vitest

  CaspianA1

  committed
  e60322a

  Copy full SHA for e60322a

• Change an error message

  CaspianA1

  committed
  81635cd

  Copy full SHA for 81635cd

• make it so that ts-morph typenames can never be undefined (this was true before, I just never noticed this earlier)

  CaspianA1

  committed
  9c0c647

  Copy full SHA for 9c0c647

• Now throwing an error when there's no ESLint node that's needed

  CaspianA1

  committed
  1e7ad2c

  Copy full SHA for 1e7ad2c

Commits on Jul 10, 2024

• Expand the test suite. Make the injection detection logic much more robust (although there are still some more cases to handle). Replace getLocal with isLocal again.

  CaspianA1

  committed
  e24815e

  Copy full SHA for e24815e

Commits on Jul 11, 2024

• Big commit. Main changes:

  Show description for 87a747d
  CaspianA1

  committed
  87a747d

  Copy full SHA for 87a747d

• Remove some whitespace

  CaspianA1

  committed
  86a003b

  Copy full SHA for 86a003b

• Add a plan on how to detect SQL injection

  CaspianA1

  committed
  18a1449

  Copy full SHA for 18a1449

• The core injection detection is now done! Really proud of how the logic worked out, it's quite elegant IMO.

  Show description for 1b27f01
  CaspianA1

  committed
  1b27f01

  Copy full SHA for 1b27f01

• Remove a part of some function names in the tests

  CaspianA1

  committed
  5a66959

  Copy full SHA for 5a66959

• Remove some code repetition

  CaspianA1

  committed
  0e27c11

  Copy full SHA for 0e27c11

• Some further test utility renaming

  CaspianA1

  committed
  346e982

  Copy full SHA for 346e982

• Split up some shared types and values. Make some more shared constants global (for easy tweaking in the future). Remove a comment, and add a TODO.

  CaspianA1

  committed
  191d5fe

  Copy full SHA for 191d5fe

• Rename some types and variables

  CaspianA1

  committed
  2ffe921

  Copy full SHA for 2ffe921

• More code cleanup

  CaspianA1

  committed
  8884735

  Copy full SHA for 8884735

• Document the justification for how the literal-reducible string stuff detect SQL injection in a more clear way. More type renaming.

  CaspianA1

  committed
  7a9d731

  Copy full SHA for 7a9d731

• Simplify the LR state that I'm caching

  CaspianA1

  committed
  7ca1c9e

  Copy full SHA for 7ca1c9e

• Clean up 'checkCallForInjection' substantially

  CaspianA1

  committed
  5b4639e

  Copy full SHA for 5b4639e

• Make the tests for SQL injection more meaningful in terms of why each one is there

  CaspianA1

  committed
  a8b3f85

  Copy full SHA for a8b3f85

• Half-remove a TODO

  CaspianA1

  committed
  988546d

  Copy full SHA for 988546d

• Make getRValuesAssignedToIdentifier a full generator (no intermediate allocation is happening anymore)

  CaspianA1

  committed
  8fbfc94

  Copy full SHA for 8fbfc94

• Make 'analyzeFunction' more streamlined (it now just goes through a decorator set error checker mapping to evaluate different determinism checkers)

  CaspianA1

  committed
  129ffa8

  Copy full SHA for 129ffa8

• Find some failure cases, and make a note about console.log

  CaspianA1

  committed
  965e07c

  Copy full SHA for 965e07c

Commits on Jul 12, 2024

• Now making using function parameters as raw sql query parameters illegal. Also rename some functions to make them clearer.

  CaspianA1

  committed
  213d6c7

  Copy full SHA for 213d6c7

• Whittle away some TODOs

  CaspianA1

  committed
  e769cd9

  Copy full SHA for e769cd9

• Now supporting template expressions when the data within them is also literal-reducible

  CaspianA1

  committed
  aa22172

  Copy full SHA for aa22172

• Some minor reformatting

  CaspianA1

  committed
  1f56de5

  Copy full SHA for 1f56de5

• Fixed some unresolved symbol errors in the tests. Also made a wrapper around symbol getting, in order to catch issues like these when constructing tests. Change the styles of some panics.

  CaspianA1

  committed
  95f2de2

  Copy full SHA for 95f2de2

• Fix some commented-out code

  CaspianA1

  committed
  9138ca2

  Copy full SHA for 9138ca2

• Comment out a panic that was breaking the e2e tests

  CaspianA1

  committed
  ee447db

  Copy full SHA for ee447db

• Make some comments more descriptive

  CaspianA1

  committed
  1dca8cd

  Copy full SHA for 1dca8cd

• Add a little TODO

  CaspianA1

  committed
  f3714cb

  Copy full SHA for f3714cb

Commits on Jul 20, 2024

• So many changes (should have probably split up into more smaller commits). But here's a summary:

  Show description for 3d6ee20
  CaspianA1

  committed
  3d6ee20

  Copy full SHA for 3d6ee20

• Make the e2e test a bit more general

  CaspianA1

  committed
  6543c0f

  Copy full SHA for 6543c0f

• Upgrade the package number

  CaspianA1

  committed
  fe54edb

  Copy full SHA for fe54edb

• Follow semver for the new version

  CaspianA1

  committed
  7865515

  Copy full SHA for 7865515

• I came up with a plan to fix most dependency issues. Part of that plan is to set peer dependencies and overrides here. The other one involves not installing typescript-eslint locally, and just inst…

  Show description for 2e26165
  CaspianA1

  committed
  2e26165

  Copy full SHA for 2e26165

Commits on Jul 22, 2024

• Draft support for more callsites. Now supporting reassignment of ctxt.client to something else. Change some formatting. Change an error message name. Add back an expected test failure for `Date.n…

  Show description for 8e0cfc8
  CaspianA1

  committed
  8e0cfc8

  Copy full SHA for 8e0cfc8

• Made a custom 'Maybe' type for all possibly undefined things

  CaspianA1

  committed
  36e1282

  Copy full SHA for 36e1282

• Make the type-getting functionality clearer

  CaspianA1

  committed
  80c44dd

  Copy full SHA for 80c44dd

Commits on Jul 23, 2024

• Now supporting Prisma as a callsite. Added some tests for that. The SQL injection checking now also checks all args for SQL injection. Make type getting work for literal types too now.

  CaspianA1

  committed
  3492577

  Copy full SHA for 3492577

• Make some code more succinct

  CaspianA1

  committed
  1777ce3

  Copy full SHA for 1777ce3

• Add a TODO for later

  CaspianA1

  committed
  c0bcce2

  Copy full SHA for c0bcce2

• Make line number reporting possible, finally! Also make some more variables const.

  CaspianA1

  committed
  301ad0f

  Copy full SHA for 301ad0f

• Move a comment

  CaspianA1

  committed
  d9a3e41

  Copy full SHA for d9a3e41

• Add a semicolon that I forgot

  CaspianA1

  committed
  322212c

  Copy full SHA for 322212c

• Now adding support for numeric literals

  CaspianA1

  committed
  5506a3a

  Copy full SHA for 5506a3a

• Upgrade some docs + tests for numeric literals

  CaspianA1

  committed
  d358b84

  Copy full SHA for d358b84

• Some minor cleanup. Leave a comment.

  CaspianA1

  committed
  2195e00

  Copy full SHA for 2195e00

• Add a blank line

  CaspianA1

  committed
  71622b9

  Copy full SHA for 71622b9

• Make a kind check more idiomatic

  CaspianA1

  committed
  6a67d2c

  Copy full SHA for 6a67d2c

• Fix some diagnostic errors

  CaspianA1

  committed
  047fd37

  Copy full SHA for 047fd37

• Update some peer dependencies

  CaspianA1

  committed
  2f5dd6c

  Copy full SHA for 2f5dd6c

• Make the module export strongly typed for the rule

  CaspianA1

  committed
  1df5b3b

  Copy full SHA for 1df5b3b

• Slight reformatting. Add a TODO.

  CaspianA1

  committed
  4a489da

  Copy full SHA for 4a489da

• Tweak package.json again

  CaspianA1

  committed
  9b1c5b1

  Copy full SHA for 9b1c5b1

• Add a PoolClient test. Can also now match against many more cases for raw SQL clients.

  CaspianA1

  committed
  d875aa7

  Copy full SHA for d875aa7

• Last package.json version

  CaspianA1

  committed
  b6a651a

  Copy full SHA for b6a651a

• Do some deduplication

  CaspianA1

  committed
  2371fd3

  Copy full SHA for 2371fd3

• Now supporting the remaining clients

  CaspianA1

  committed
  176ecba

  Copy full SHA for 176ecba

• Merge 2 TODOs into 1

  CaspianA1

  committed
  52c7778

  Copy full SHA for 52c7778

• Leave a big comment about the biggest bug at hand

  CaspianA1

  committed
  88d2ccb

  Copy full SHA for 88d2ccb

• Now only checking the first argument again for raw SQL queries

  CaspianA1

  committed
  b5eb76c

  Copy full SHA for b5eb76c

Commits on Jul 24, 2024

• Final final version of dependencies! Will upgrade the docs to note additional installation instructions later.

  CaspianA1

  committed
  6a370d0

  Copy full SHA for 6a370d0

• A bit of cleanup

  CaspianA1

  committed
  bb099c8

  Copy full SHA for bb099c8

• Add 2 more unit tests

  CaspianA1

  committed
  47cef34

  Copy full SHA for 47cef34

• Remove peer dependencies

  CaspianA1

  committed
  f266058

  Copy full SHA for f266058

• Now checking all functions for SQL injection, not just transaction functions

  CaspianA1

  committed
  899f371

  Copy full SHA for 899f371

• Add a useful link

  CaspianA1

  committed
  7f57a98

  Copy full SHA for 7f57a98

• Add a future idea

  CaspianA1

  committed
  b4df168

  Copy full SHA for b4df168

• Change some var names

  CaspianA1

  committed
  ebea21d

  Copy full SHA for ebea21d

• Slight formatting tweak

  CaspianA1

  committed
  b83e1ea

  Copy full SHA for b83e1ea

• Make some naming more clear

  CaspianA1

  committed
  35ef464

  Copy full SHA for 35ef464

• Remove a comma

  CaspianA1

  committed
  5759bda

  Copy full SHA for 5759bda

• Now, if vars used for sql queries are not local, the whole program scope is examined.

  CaspianA1

  committed
  5cbf7b7

  Copy full SHA for 5cbf7b7

• Clean up some old code

  CaspianA1

  committed
  8c17333

  Copy full SHA for 8c17333

• Now failing with a more descriptive error message for versioning issues

  CaspianA1

  committed
  5c03bbe

  Copy full SHA for 5c03bbe

Commits on Jul 25, 2024

• Tweak the versioning error

  CaspianA1

  committed
  db6677d

  Copy full SHA for db6677d

• Improve a variable name

  CaspianA1

  committed
  ef8c00c

  Copy full SHA for ef8c00c