github / github/codeql

C#: Azure Function HttpTrigger SQL Injection is not being detected

Abierto
#15,102 5 comentarios 0 reacciones 0 asignados Ver en GitHub
question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

**Description of the issue**

CodeQL scan is not picking up SQL Injection vulnerability in the following Azure Function trigger:

```csharp
using System.Net;
using Microsoft.Azure.Functions.Worker;
using Microsoft.Azure.Functions.Worker.Http;
using Microsoft.Data.Sqlite;
using Microsoft.Extensions.Logging;
using Dapper;

namespace DavidF.Demo.GithubActions.Functions;

public class HelloWorldFunction
{
private readonly SqliteConnection _sqliteConnection;
private readonly ILogger _logger;

public HelloWorldFunction(ILoggerFactory loggerFactory, SqliteConnection sqliteConnection)
{
_sqliteConnection = sqliteConnection;
_logger = loggerFactory.CreateLogger();
}

[Function("HelloWorldFunction")]
public async Task Run([HttpTrigger(AuthorizationLevel.Function, "get", "post")] HttpRequestData req)
{
_logger.LogInformation("C# HTTP trigger function processed a request.");

var sql = $"SELECT * FROM USER WHERE Name = '{req.Query["name"]}'";

_sqliteConnection.Open();

var res = await _sqliteConnection.QueryAsync(sql);

var response = req.CreateResponse(HttpStatusCode.OK);

await response.WriteAsJsonAsync(res);

return response;
}

public record UserDto(long Id, string Name);
}
```

Tested in GitHub actions and also locally using CLI:

```powershell
c:\codeql\codeql.exe database analyze "codeql-db" --format=sarif-latest --output="codeql-output" --threads=0 '..\codeql\csharp\ql\src\Security Features\cwe-089\SqlInjection.ql'
```

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Start with the C# SQL injection query at ql/src/Security Features/cwe-089/SqlInjection.ql and reproduce the report using the provided CodeQL CLI database-analyze command. Compare the query's results with the Azure Function example; done means the vulnerable interpolated query is detected in the SARIF output.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
azure, csharp, sqlite
Área
security
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
35/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.