Marcos Silva
24 lines
943 B
Markdown
24 lines
943 B
Markdown
---
|
|
name: sql-injection-audit
|
|
description: Audit a changed code path for SQL injection. Use when code constructs or executes SQL, query-builder fragments, or ORM raw queries.
|
|
---
|
|
|
|
# sql-injection-audit
|
|
|
|
## Inputs
|
|
Changed files, branch diff, or a named query path.
|
|
|
|
## Workflow
|
|
1. Find SQL execution sinks and trace request, CLI, external, and stored user input to them.
|
|
2. Confirm values use driver or ORM parameters. For dynamic identifiers, confirm a finite allowlist maps a user choice to a trusted token.
|
|
3. Review raw-query escape hatches and stored procedures.
|
|
4. Report only evidenced findings with source, sink, location, impact, and a safe pattern.
|
|
|
|
## Rules
|
|
- Escaping is not a substitute for parameterization.
|
|
- Passing tests are supporting evidence, not proof of safety.
|
|
- Do not modify code unless the user asks for a fix.
|
|
|
|
## Output
|
|
Return a findings table and the scope reviewed; say explicitly when a path could not be traced.
|