Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

False positive with commands that cannot execute SQL #24

Open
nferraz opened this issue Nov 22, 2019 · 0 comments
Open

False positive with commands that cannot execute SQL #24

nferraz opened this issue Nov 22, 2019 · 0 comments

Comments

@nferraz
Copy link

nferraz commented Nov 22, 2019

This policy identifies the following string (used in a die) as potential target for SQL injections:

die "Select returned: $error";

Same thing with other functions that are commonly used for logging and error handling:

INFO "Delete record $id";
warn "Update returned: $error";
croak "Insert returned: $error";

Here's a patch to whitelist functions that are considered "safe": #23

@nferraz nferraz changed the title False positive with commands cannot execute SQL False positive with commands that cannot execute SQL Nov 22, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant