Merge pull request #490 from AikidoSec/update-zen-internals

AIK-4113: Update Zen internals to v0.1.34

Author: willem-delbare

Makefile

@@ -1,4 +1,4 @@
-INTERNALS_VERSION = v0.1.32
+INTERNALS_VERSION = v0.1.34
 INTERNALS_URL = https://github.com/AikidoSec/zen-internals/releases/download/$(INTERNALS_VERSION)
 TARBALL = zen_internals.tgz
 CHECKSUM_FILE = zen_internals.tgz.sha256sum

library/vulnerabilities/sql-injection/detectSQLInjection.sqlite.test.ts

@@ -23,6 +23,13 @@ t.test("It ignores postgres dollar signs", async () => {
   isNotSQLInjection("SELECT $tag$text$tag$", "$tag$text$tag$");
 });
 
+t.test("$$ is treated as placeholder", async () => {
+  isSqlInjection(
+    "SELECT * FROM users WHERE id = '1' OR $$ IS NULL -- '",
+    "1' OR $$ IS NULL -- "
+  );
+});
+
 function isSqlInjection(sql: string, input: string) {
   t.same(detectSQLInjection(sql, input, new SQLDialectSQLite()), true, sql);
 }