Fix SQLi rule false positive

ajinabraham · Jan 30, 2022 · 54fdb3d · 54fdb3d
1 parent 5ba6ea0
commit 54fdb3d
Showing 1 changed file with 14 additions and 1 deletion.
diff --git a/njsscan/rules/semantic_grep/database/sql_injection.yaml b/njsscan/rules/semantic_grep/database/sql_injection.yaml
@@ -1,6 +1,19 @@
 rules:
   - id: node_sqli_injection
     patterns:
+      - pattern-either:
+          - pattern-inside: |
+              require('sql-client')
+              ...
+          - pattern-inside: |
+              require('mysql')
+              ...
+          - pattern-inside: |
+              require('pg')
+              ...
+          - pattern-inside: |
+              require('mssql')
+              ...
       - pattern-either:
           - pattern: |
               $CON.query(<... $REQ.$QUERY.$VAR ...>, ...)
@@ -33,7 +46,7 @@ rules:
       - javascript
     severity: ERROR
     metadata:
-      owasp: 'A1: Injection'
+      owasp: "A1: Injection"
       cwe: >-
         CWE-89: Improper Neutralization of Special Elements used in an SQL
         Command ('SQL Injection')