sicua/dist/analyzers/security/detectors/SqlInjectionDetector.d.ts

A tool for analyzing project structure and dependencies

/**
 * Detector for SQL injection vulnerabilities
 */
import { BaseDetector } from "./BaseDetector";
import { Vulnerability } from "../types/vulnerability.types";
import { ScanResult } from "../../../types";
export declare class SqlInjectionDetector extends BaseDetector {
    private static readonly SQL_PATTERNS;
    constructor();
    detect(scanResult: ScanResult): Promise<Vulnerability[]>;
    /**
     * Detect SQL libraries used in the file
     */
    private detectSqlLibraries;
    /**
     * Check if content has SQL-related patterns
     */
    private hasSqlContent;
    /**
     * Validate if a SQL pattern match is problematic
     */
    private validateSqlMatch;
    /**
     * AST-based analysis for SQL injection patterns
     */
    private analyzeASTForSqlInjection;
    /**
     * Find SQL execution method calls
     */
    private findSqlExecutionCalls;
    /**
     * Find template literals that contain SQL keywords
     */
    private findSqlTemplateLiterals;
    /**
     * Find variable assignments that actually contain SQL queries (more selective)
     */
    private findActualSqlVariableAssignments;
    /**
     * Analyze SQL execution call for injection vulnerabilities
     */
    private analyzeSqlCall;
    /**
     * Analyze template literal for SQL injection
     */
    private analyzeTemplateLiteral;
    /**
     * Analyze SQL variable assignment
     */
    private analyzeSqlVariable;
    /**
     * Get SQL method name from call expression
     */
    private getSqlMethodName;
    /**
     * Analyze SQL call arguments for user input
     */
    private analyzeSqlArguments;
    /**
     * Extract user input sources from expression
     */
    private extractUserInputFromExpression;
    /**
     * Extract user input from template literal spans
     */
    private extractUserInputFromTemplate;
    /**
     * Get property access path as string
     */
    private getPropertyAccessPath;
    /**
     * Check if query uses parameterization
     */
    private hasParameterization;
    /**
     * Check if expression uses unsafe string construction
     */
    private hasUnsafeStringConstruction;
    /**
     * Determine confidence level based on input sources
     */
    private determineConfidenceLevel;
    /**
     * Extract function name from AST node context
     */
    private extractFunctionFromAST;
}