From f9ab37f5a071e275fcd3a30d071eadce0b629880 Mon Sep 17 00:00:00 2001 From: Richard Roggenkemper Date: Fri, 6 Jun 2025 14:17:57 -0700 Subject: [PATCH 1/5] fix empty string --- .../performance_issues/detectors/sql_injection_detector.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py b/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py index a03fefe7045b31..1df1c6363c9980 100644 --- a/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py +++ b/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py @@ -83,7 +83,7 @@ def extract_request_data(self, event: dict[str, Any]) -> None: query_value = query_pair[1] query_key = query_pair[0] - if not isinstance(query_value, str): + if not isinstance(query_value, str) or not query_value: continue if query_key == query_value: continue From 3faea1250126dab70cd43866f41890cd750d2c02 Mon Sep 17 00:00:00 2001 From: Richard Roggenkemper Date: Fri, 6 Jun 2025 14:20:44 -0700 Subject: [PATCH 2/5] update test --- .../sql-injection/sql-injection-event-query.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fixtures/events/performance_problems/sql-injection/sql-injection-event-query.json b/fixtures/events/performance_problems/sql-injection/sql-injection-event-query.json index 232c62326f7a56..39784b04db199d 100644 --- a/fixtures/events/performance_problems/sql-injection/sql-injection-event-query.json +++ b/fixtures/events/performance_problems/sql-injection/sql-injection-event-query.json @@ -20,7 +20,8 @@ "method": "GET", "query_string": [ ["username", "hello"], - ["sort", "username"] + ["sort", "username"], + ["empty", ""] ] }, "spans": [ From 8290602bfc9a645bc88f98b880faf673c8721822 Mon Sep 17 00:00:00 2001 From: Richard Roggenkemper Date: Fri, 6 Jun 2025 14:23:54 -0700 Subject: [PATCH 3/5] check value for sql keywords --- .../performance_issues/detectors/sql_injection_detector.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py b/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py index 1df1c6363c9980..0415fc940f4021 100644 --- a/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py +++ b/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py @@ -87,7 +87,7 @@ def extract_request_data(self, event: dict[str, Any]) -> None: continue if query_key == query_value: continue - if query_value.upper() in SQL_KEYWORDS: + if query_value.upper() in SQL_KEYWORDS or query_key.upper() in SQL_KEYWORDS: continue valid_parameters.append(query_pair) From f1eb1350d86078d216d91c0f243631d0b9e03c33 Mon Sep 17 00:00:00 2001 From: Richard Roggenkemper Date: Fri, 6 Jun 2025 16:08:54 -0700 Subject: [PATCH 4/5] add additional check for length 1 --- .../sql-injection/sql-injection-event-query.json | 3 ++- .../performance_issues/detectors/sql_injection_detector.py | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/fixtures/events/performance_problems/sql-injection/sql-injection-event-query.json b/fixtures/events/performance_problems/sql-injection/sql-injection-event-query.json index 39784b04db199d..53bcbe47c39ff6 100644 --- a/fixtures/events/performance_problems/sql-injection/sql-injection-event-query.json +++ b/fixtures/events/performance_problems/sql-injection/sql-injection-event-query.json @@ -21,7 +21,8 @@ "query_string": [ ["username", "hello"], ["sort", "username"], - ["empty", ""] + ["empty", ""], + ["single", "u"] ] }, "spans": [ diff --git a/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py b/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py index 0415fc940f4021..d67779185f636f 100644 --- a/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py +++ b/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py @@ -83,7 +83,8 @@ def extract_request_data(self, event: dict[str, Any]) -> None: query_value = query_pair[1] query_key = query_pair[0] - if not isinstance(query_value, str) or not query_value: + # Filters out empty strings or single character strings + if not isinstance(query_value, str) or not query_value or len(query_value) == 1: continue if query_key == query_value: continue From 367514206f693ddcb6ca32fc182bb495bd45b218 Mon Sep 17 00:00:00 2001 From: Richard Roggenkemper Date: Fri, 6 Jun 2025 16:28:59 -0700 Subject: [PATCH 5/5] add string check --- .../performance_issues/detectors/sql_injection_detector.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py b/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py index d67779185f636f..8890295f0cb6e7 100644 --- a/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py +++ b/src/sentry/utils/performance_issues/detectors/sql_injection_detector.py @@ -84,7 +84,12 @@ def extract_request_data(self, event: dict[str, Any]) -> None: query_key = query_pair[0] # Filters out empty strings or single character strings - if not isinstance(query_value, str) or not query_value or len(query_value) == 1: + if ( + not isinstance(query_value, str) + or not isinstance(query_key, str) + or not query_value + or len(query_value) == 1 + ): continue if query_key == query_value: continue