sqli-deep

Files (1)

• SKILL.md

SKILL.md (first lines)

Perform a taint-analysis-style SQL injection review of: $ARGUMENTS

## Step 1: Identify Input Sources
Find all locations where user-controlled data enters the application:
- HTTP request parameters, body, headers, cookies
- URL path parameters
- File uploads, form fields
- External API responses used in queries

## Step 2: Identify Query Sinks
Find all locations where SQL is constructed or executed:
- Raw query strings: `query(`, `execute(`, `cursor.execute(`, `db.query(`, `connection.query(`
- String formatting into queries: f-strings, `.format()`, `%` interpolation, `+` concatenation
- ORM escape hatches: `.raw(`, `RawSQL(`, `extra(`, `execute_sql(`, `text(` (SQLAlchemy), `query_builder->whereRaw(`

## Step 3: Trace Data Flow
For each sink, trace backwards: does unsanitized user input reach it?
- Direct path: `query = "SELECT * FROM users WHERE id = " + request.args['id']`
- Indirect path: input stored in variable, passed through functions, reaches sink
- Second-order: input stored in DB, later retrieved and used in another query

## Step 4: Classify Findings
- **Confirmed**: clear unsanitized user input to query sink
- **Probable**: input reaches sink through code path that appears unsanitized but requires confirmation
- **False positive risk**: parameterized but worth noting for review

## Output
For each finding: file:line, input source, sink, data flow path, exploitation scenario, parameterization fix.

From jcvernaleo/llm-scripts, ISC.

More from jcvernaleo/llm-scripts