microsoft / microsoft/azurechat
SQL Injection
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1.4k
- Forks
- 1.3k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 1
Description
We have implemented a Azure WAF around the installation of this accelerator , and have the default OWASP managed rule set implemented . We get hundreds of failures when users use this application , it is unsafe .
Can you look at fixing this code , so it can be used without fear of SQL Injection ?
QUEST-942-APPLICATION-ATTACK-SQLI.conf
Pattern match (?i:(?:\A|[^\d])0x[a-f\d]{3,}) at REQUEST_COOKIES.REQUEST-942-APPLICATION-ATTACK-SQLI
REQUEST-949-BLOCKING-EVALUATION.conf
Missing User Agent Header
Thanks
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no source files, tests, or application entry points. Begin by reproducing the Azure WAF reports for REQUEST_COOKIES and the missing User Agent header, then trace those requests into the application. Done means the reported traffic no longer triggers the stated rules without compromising normal application use.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, sql, typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100