Inject SQL only into strings that have SELECT/UPDATE... at the beginning

This commit is contained in:
Andrey Vlasovskikh
2014-01-22 19:44:57 +04:00
parent 66827e2765
commit 7ca0e527f8

View File

@@ -9,6 +9,6 @@
</injection>
<injection language="SQL" injector-id="python">
<display-name>"SQL select/delete/insert/update/create"</display-name>
<place><![CDATA[pyLiteralExpression().withText(string().matchesBrics(".*(((SELECT|DELETE) .*FROM)|((INSERT|REPLACE) .*INTO)|(UPDATE .* SET)|((CREATE|DROP|ALTER) +(TABLE|INDEX))) .*"))]]></place>
<place><![CDATA[pyLiteralExpression().withText(string().matchesBrics(".{0,5}(((SELECT|DELETE) .*FROM)|((INSERT|REPLACE) .*INTO)|(UPDATE .* SET)|((CREATE|DROP|ALTER) +(TABLE|INDEX))) .*"))]]></place>
</injection>
</component>