git.iko.soy/helix
on master help sign in
queries/php: add injections for regex and sql injection (#6250)
3907358Ivan
runtime/queries/php/injections.scm+19
compare with master
unifiedsplit
@@ -4,3 +4,22 @@
4
4
5((comment) @injection.content
5((comment) @injection.content
6 (#set! injection.language "comment"))
6 (#set! injection.language "comment"))
7+
8+((function_call_expression
9+ function: (name) @_function
10+ arguments: (arguments . (argument (_ (string_value) @injection.content))))
11+ (#match? @_function "^preg_")
12+ (#set! injection.language "regex"))
13+
14+((function_call_expression
15+ function: (name) @_function
16+ arguments: (arguments (_) (argument (_ (string_value) @injection.content))))
17+ (#match? @_function "^mysqli_")
18+ (#set! injection.language "sql"))
19+
20+((member_call_expression
21+ object: (_)
22+ name: (name) @_function
23+ arguments: (arguments . (argument (_ (string_value) @injection.content))))
24+ (#match? @_function "^(prepare|query)$")
25+ (#set! injection.language "sql"))