C#: Azure Function HttpTrigger SQL Injection is not being detected
- Langage dominant
- CodeQL
- Étoiles
- 10.1k
- Forks
- 2.1k
- Merge moyen
- 2 j 15 h
- PR mergées (30 j)
- 141
Description
**Description of the issue**
CodeQL scan is not picking up SQL Injection vulnerability in the following Azure Function trigger:
```csharp
using System.Net;
using Microsoft.Azure.Functions.Worker;
using Microsoft.Azure.Functions.Worker.Http;
using Microsoft.Data.Sqlite;
using Microsoft.Extensions.Logging;
using Dapper;
namespace DavidF.Demo.GithubActions.Functions;
public class HelloWorldFunction
{
private readonly SqliteConnection _sqliteConnection;
private readonly ILogger _logger;
public HelloWorldFunction(ILoggerFactory loggerFactory, SqliteConnection sqliteConnection)
{
_sqliteConnection = sqliteConnection;
_logger = loggerFactory.CreateLogger();
}
[Function("HelloWorldFunction")]
public async Task Run([HttpTrigger(AuthorizationLevel.Function, "get", "post")] HttpRequestData req)
{
_logger.LogInformation("C# HTTP trigger function processed a request.");
var sql = $"SELECT * FROM USER WHERE Name = '{req.Query["name"]}'";
_sqliteConnection.Open();
var res = await _sqliteConnection.QueryAsync(sql);
var response = req.CreateResponse(HttpStatusCode.OK);
await response.WriteAsJsonAsync(res);
return response;
}
public record UserDto(long Id, string Name);
}
```
Tested in GitHub actions and also locally using CLI:
```powershell
c:\codeql\codeql.exe database analyze "codeql-db" --format=sarif-latest --output="codeql-output" --threads=0 '..\codeql\csharp\ql\src\Security Features\cwe-089\SqlInjection.ql'
```
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Start with the C# SQL injection query at ql/src/Security Features/cwe-089/SqlInjection.ql and reproduce the report using the provided CodeQL CLI database-analyze command. Compare the query's results with the Azure Function example; done means the vulnerable interpolated query is detected in the SARIF output.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- azure, csharp, sqlite
- Domaine
- security
- Type d'issue
- Bug
- Difficulté
- 4/5
- Temps estimé
- 3-5 jours
- Activité
- À l'abandon
- Clarté
- Plutôt claire
- Accessibilité débutants
- 35/100