Repository navigation
fix(rules): sql-concat rules flag prose ("Insert failed") and allowlisted identifier interpolation #662
Description
Problem
injection/sql-concat and sec-sql-concat (CRITICAL) fire on prose and on safe identifier interpolation. Same scan as the sibling issue (38/38 Critical/Major findings were false positives): 8 of them are SQL rules, none was an injection.
Reproduction (single lines through cora.check_snippet)
| Snippet | Result | Why it is not injection |
|---|---|---|
.map_err(|e| format!("Insert failed: {e}"))?; |
injection/sql-concat |
an error message, not SQL |
text: format!("Deleted tag '{}' ({} memories updated)", tag, count), |
injection/sql-concat |
a user-facing message |
self.conn.prepare(&format!("SELECT * FROM {table} LIMIT 0")) |
sec-sql-concat |
table is checked against an ALLOWED_TABLES list first; identifiers cannot be bound as parameters |
let sql = format!("UPDATE documents SET {set_sql} WHERE id = ?{param_idx}"); |
injection/sql-concat |
set_sql is joined from fixed fragments with numbered parameters |
Suspected cause
injection/sql-concat matches format!(" followed by SELECT|INSERT|UPDATE|DELETE case-insensitively with no word boundary and no SQL structure, so "Insert failed" and "Deleted tag" match. sec-sql-concat matches any format!("SELECT.
Proposal
- Require SQL structure in the literal (
SELECT ... FROM,INSERT INTO,UPDATE ... SET,DELETE FROM), a word boundary after the keyword, and match case-sensitively unless the literal is clearly SQL. - Flag interpolation in a value position (after
=,LIKE,IN (,VALUES (), not in identifier position (FROM {table},SET {col}), which cannot be parameterized, and downgrade it to a Minor note. - Keep
f"SELECT ... {user_input}"/"..." + userstyle findings.
Done when
The four snippets are clean (or at most Minor for the identifier cases), true concatenation of a value is still CRITICAL, with tests for both.
Activity
fix(rules): sql-concat rules ignore prose and identifier interpolation (
fix(rules): sql-concat rules ignore prose and identifier interpolation (