hohn/codeql-intro-csharp
1
0
Fork 0
mirror of https://github.com/hohn/codeql-intro-csharp.git synced 2025-12-16 18:53:05 +01:00
Code Issues Packages Projects Releases Wiki Activity

** SQL Injection Code Sample Run

Browse Source
This commit is contained in:
Michael Hohn
2024-12-04 14:23:20 -08:00
committed by =Michael Hohn
parent a2901f0327
commit 8fe590f294
1 changed files with 32 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
README.org
View File

@@ -80,38 +80,6 @@
# Parse error near line 2: no such table: users # Parse error near line 2: no such table: users
#+END_SRC #+END_SRC
* SQL Injection Code Sample Run
#+BEGIN_SRC sh
# All run in pwsh, typical prompt is
# PS /Users/hohn/work-gh/codeql-intro-csharp>
# Build
cd $HOME/work-gh/codeql-intro-csharp
./build.ps1
# Prepare db
./admin.ps1 -r
./admin.ps1 -c
./admin.ps1 -s
# Add regular user interactively
./build.ps1
./SqliDemo/bin/Debug/net9.0/SqliDemo
hello user
# Check
./admin.ps1 -s
# Add Johnny Droptable
./SqliDemo/bin/Debug/net9.0/SqliDemo
Johnny'); DROP TABLE users; --
# And the problem:
./admin.ps1 -s
Parse error near line 1: no such table: users
#+END_SRC
* NEXT Build CodeQL Database * NEXT Build CodeQL Database
To get started, build the codeql database (adjust paths to your setup). To get started, build the codeql database (adjust paths to your setup).
@@ -187,6 +155,38 @@
#+END_SRC #+END_SRC
* CodeQL for Query Writers * CodeQL for Query Writers
** SQL Injection Code Sample Run
#+BEGIN_SRC sh
# All run in pwsh, typical prompt is
# PS /Users/hohn/work-gh/codeql-intro-csharp>
# Build
cd $HOME/work-gh/codeql-intro-csharp
./build.ps1
# Prepare db
./admin.ps1 -r
./admin.ps1 -c
./admin.ps1 -s
# Add regular user interactively
./build.ps1
./SqliDemo/bin/Debug/net9.0/SqliDemo
hello user
# Check
./admin.ps1 -s
# Add Johnny Droptable
./SqliDemo/bin/Debug/net9.0/SqliDemo
Johnny'); DROP TABLE users; --
# And the problem:
./admin.ps1 -s
Parse error near line 1: no such table: users
#+END_SRC
** Identify the problem ** Identify the problem
=./SqliDemo/bin/Debug/net9.0/SqliDemo= is reading from =STDIN=, and writing to =./SqliDemo/bin/Debug/net9.0/SqliDemo= is reading from =STDIN=, and writing to
a database; looking at the code in a database; looking at the code in