class Crowbar::Rules::SQLRule

Overview

Structure-preserving rule for SQL statements. Preserves overall query grammar skeleton (keywords, clauses, commas, parens) while mutating numeric literals, string literals, comparison operators, and clauses.

Defined in:

crowbar/rules/sql.cr

Constant Summary

OPERATORS = ["=", "!=", "<>", ">", "<", ">=", "<=", "LIKE", "NOT LIKE", "IN", "IS"]
SQL_KEYWORDS = ["SELECT", "INSERT", "UPDATE", "DELETE", "CREATE", "DROP", "ALTER", "WITH", "REPLACE", "MERGE", "TRUNCATE", "EXPLAIN"]
SQLI_PROBES = ["'' OR '1'='1", "' OR 1=1 --", "' UNION SELECT null, null --", "admin'/*", "' AND SLEEP(5) --", "1; DROP TABLE users; --", "'\u0000'--", "'\u202Eadmin'--"]

Instance Method Summary

Instance methods inherited from class Crowbar::Rule

apply(context : Context, buffer : Buffer) : Bool apply, description : String description, match?(buffer : Buffer) : Bool match?, name : String name, targets(*targets : Symbol) targets, weight : Float64 weight, weight=(weight : Float64) weight=

Constructor methods inherited from class Crowbar::Rule

new(weight : Float64 = 1.0) new

Instance Method Detail

def apply(context : Context, buffer : Buffer) : Bool #
Description copied from class Crowbar::Rule

Applies a structure-preserving transformation to the buffer


def description : String #

def match?(buffer : Buffer) : Bool #
Description copied from class Crowbar::Rule

Checks whether the buffer matches the format handled by this rule


def name : String #