Skip to content

Conversation

@Xhoenix
Copy link
Member

@Xhoenix Xhoenix commented Oct 2, 2024

Added fix for rule 942120.

@Xhoenix Xhoenix requested a review from a team October 2, 2024 10:48
@fzipi fzipi changed the title fix(security): sql operator bypass fix(942120): add double equal operator Oct 2, 2024
@fzipi
Copy link
Member

fzipi commented Oct 2, 2024

Thanks for the patch. Is there any other operator we are missing?

@fzipi
Copy link
Member

fzipi commented Oct 2, 2024

Does this even make sense then?

[<>=!]{1,2}\s*all\b

@Xhoenix
Copy link
Member Author

Xhoenix commented Oct 2, 2024

I looked at the operators from here.

Does this even make sense then?

[<>=!]{1,2}\s*all\b

No, that's unnecessary, going to remove it.

@Xhoenix
Copy link
Member Author

Xhoenix commented Oct 2, 2024

On a second thought, there are no tests for it, so can't say for sure exactly what they were targeting.

=all
!all
<all

@Xhoenix
Copy link
Member Author

Xhoenix commented Oct 2, 2024

Test ID 26 exists. But then the expansion part {1,2} is unnecessary.

@fzipi
Copy link
Member

fzipi commented Oct 2, 2024

I think it will never match the ,2} part, right? Will previously match the other operators.

From that list we are missing:

@fzipi fzipi changed the title fix(942120): add double equal operator fix(942120): update operators Oct 2, 2024
@Xhoenix
Copy link
Member Author

Xhoenix commented Oct 2, 2024

I'm going to remove <=>, add -> and remove {1,2}. Are you okay with this @fzipi ?

@fzipi
Copy link
Member

fzipi commented Oct 2, 2024

Sounds good to me!

@Xhoenix
Copy link
Member Author

Xhoenix commented Oct 3, 2024

LGTM!

Copy link
Member

@fzipi fzipi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can merge this one after updating tests, and then maybe work on moving operators to an include file?

@Xhoenix
Copy link
Member Author

Xhoenix commented Oct 5, 2024

Yeah, moving into an include file would make sense, but I've only referred into the operators for SQLite, and we may need to look into other database engines, for e.g mysql.

Copy link
Member

@fzipi fzipi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is taking a nice shape now. Let's add to the test description a way of reading the test content more easily.

fzipi
fzipi previously approved these changes Oct 5, 2024
@azurit azurit requested a review from theseion October 9, 2024 07:48
Xhoenix and others added 2 commits October 9, 2024 17:53
@Xhoenix
Copy link
Member Author

Xhoenix commented Oct 9, 2024

This is now ready. LGTM!

@dune73
Copy link
Member

dune73 commented Oct 9, 2024

We're getting there.

@Xhoenix Xhoenix added this pull request to the merge queue Oct 11, 2024
Merged via the queue into coreruleset:main with commit 71e0dff Oct 11, 2024
5 checks passed
@Xhoenix Xhoenix deleted the fix-sql-operator-bypass branch October 11, 2024 18:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants