Timeline for Is it possible to detect 100% of SQLi with a simple regex?
Current License: CC BY-SA 4.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 11, 2019 at 15:00 | comment | added | Lucas Rodrigues Sena | Considering the other side of the concept, "of course it is not recommended", also I can create a regex able to block 100% of query variety, so this answer cannot be "No". I had a case that one manager was able to store new queries as a varchar, so then the clients was able to fill part of them, which "params" ORM method will never allow this kind o process. | |
| Feb 22, 2019 at 9:39 | comment | added | schroeder♦ | @luis.espinal I have no idea why you are getting both emotional and resistent to simply editing your answer to explain what you mean. If you see needing to explain yourself as a challenge to your ability to know the correct answer, then you need to rethink your motivations for answering at all. | |
| Feb 22, 2019 at 9:33 | comment | added | schroeder♦ | @luis.espinal your response is irrational and emotion-driven. There has been no dishonesty. Please understand that you have "the curse of knowledge" and you need to be able to explain concepts to people who have not heard the definitions or concepts you are using. This is not a site for people to show off the "right answers". This is a Q&A site, which by its very nature means that answers need to not just be as correct as they can be, but understood by the people who might barely understand their own questions. | |
| Feb 21, 2019 at 16:37 | comment | added | luis.espinal | "Big difference between being right and being useful." That's a different argument than the one you originally said (that what I said appeared false on its face.) This is disingenuous and dishonest. I'm not interested in engaging in an argument started out with dishonesty. Furthermore, my answer is not the only one delving on the subject of context-free grammars. So screw this. Down vote the whole thing or ask someone else to edit or delete the answer entirely. I'm OK with either. | |
| Feb 20, 2019 at 20:37 | comment | added | Mike Samuel | A non-CF language may have a regular lexical grammar, so you don't need to match the whole SQL grammar. Just identify strings that might break token boundaries when interpolated into an existing sequence of tokens. That said, I agree with all the posters who have pointed out that filters have a poor track record compared to safety-by-construction. | |
| Feb 20, 2019 at 16:18 | comment | added | Captain Man | To be fair, SQL injection attacks aren't necessarily valid SQL. (Once they are put into the rest of the query they are.) Because of that it isn't an issue if we can or cannot detect valid SQL with regex. | |
| Feb 20, 2019 at 15:39 | comment | added | schroeder♦ | Big difference between being right and being useful. This answer is not useful without the reader delving into several computer science concepts to begin to understand the point you are making. I'm asking you to edit the answer to connect some dots to make this answer more useful. | |
| Feb 20, 2019 at 15:26 | comment | added | luis.espinal | That's me connecting the dots using standard formal grammar definitions. If I'm wrong,point it out. Anything beyond this will require us to visit a textbook or do some sort of formal proof. | |
| Feb 20, 2019 at 15:25 | comment | added | luis.espinal | I'm using textbook definitions: a grammar (in this case SQL) described in BNF is a context-free grammar. And because it contains recursion (see previous example I mentioned), it cannot be accepted by a non-deterministic finite automaton or NFA. And that by definition is a non-regular language. | |
| Feb 20, 2019 at 14:03 | comment | added | schroeder♦ | You appear to be jumping ahead in some concepts. How do we get to "context-free" from "can be described in BNF"? I think you are bringing in volumes of other concepts without explaining them (or assuming they are true). While I am not trying to assert something else to be true, it is not clear from your answer how your assertions are true. Can you connect some dots? | |
| Feb 20, 2019 at 13:44 | comment | added | luis.espinal | Since we have established that SQL is context-free (because it can be represented in BNF) and it is not regular (since a regular grammar cannot capture recursion), then we can conclude that SQL is a non-regular context free language. After all, all regular grammars are context-free, but not all context-free grammars are regular. | |
| Feb 20, 2019 at 13:42 | comment | added | luis.espinal |
Additionally, SQL is neither a right regular grammar nor a left regular grammar. In fact, there's no regular grammar than can capture SELECT x from y where either x or y are SQL SELECT statements themselves.
|
|
| Feb 20, 2019 at 13:40 | comment | added | luis.espinal | Uh, no. For starters, SQL has been described multiple times in BNF, ergo, it is a context-free language. Here's an example: docs.oracle.com/cd/B28359_01/server.111/b28286/ap_syntx002.htm | |
| Feb 20, 2019 at 13:20 | comment | added | schroeder♦ | SQL is a "non-regular context free language". That's going to need some explanation because that appears false on its face. | |
| Feb 20, 2019 at 13:15 | review | First posts | |||
| Feb 20, 2019 at 14:25 | |||||
| Feb 20, 2019 at 13:13 | history | answered | luis.espinal | CC BY-SA 4.0 |