Skip to content

Conversation

MathiasVP
Copy link
Collaborator

@MathiasVP MathiasVP commented Sep 11, 2025

This PR adds two improvements to the SQL Injection query for PowerShell:

  1. It adds a barrier on validated parameters. This is just a copy-paste of the same barrier used in the command injection query.
  2. It fixes up an omission from PS: Do not alert on inputfile in the SQL injection query #281. In that PR we removed inputfile from the set of sinks, but we forgot to remove it from implicit reads. This has been fixed in this PR!

Commit-by-commit review recommended.

@MathiasVP MathiasVP changed the title PS: Add more barriers to the SQL injection query PS: Remove from FPs from the SQL injection query. Sep 11, 2025
@chanel-y chanel-y merged commit 9681711 into main Sep 11, 2025
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants