python sql注入检测_在源代码中检测SQL注入

不确定这将如何与其他包进行比较，但在某种程度上，您需要解析传递给cursor.execute的参数。这段pyparsing代码寻找：使用字符串插值的参数

使用字符串与变量名串联的参数

只是变量名的参数

但是有时参数使用字符串连接只是为了将一个长字符串分解成-如果表达式中的所有字符串都是被加在一起的文本，就没有SQL注入的风险。在

此pyparsing片段将查找对光标.执行，然后查找存在风险的论点形式：from pyparsing import *

import re

identifier = Word(alphas, alphanums+'_')

integer = Word(nums)

LPAR,RPAR,PLUS,PERCENT = map(Literal, '()+%')

stringInterpRE = re.compile(r"%-?\d*\*?\.?\d*\*?s")

def containsStringInterpolation(s,l,tokens):

if not stringInterpRE.search(tokens[0]):

raise ParseException(s,l,"No string interpolation")

tupleContents = identifier | integer

tupleExpr = LPAR + delimitedList(tupleContents) + RPAR

stringInterpArg = identifier | tupleExpr

interpolatedString = originalTextFor(quotedString.copy().setParseAction(containsStringInterpolation) +

PERCENT + stringInterpArg)

stringTerm = interpolatedString | OneOrMore(quotedString.copy()) | identifier

stringTerm.setName("stringTerm")

unsafeStringExpr = (stringTerm + OneOrMore(PLUS + stringTerm)) | identifier | interpolatedString

def unsafeExpr(s,l,tokens):

if not any(term == interpolatedString or term == identifier

for term in tokens):

raise ParseException(s,l,"No unsafe string terms")

unsafeStringExpr.setParseAction(unsafeExpr)

unsafeStringExpr.setName("unsafeExpr")

func = Literal("cursor.execute")

statement = func + LPAR + unsafeStringExpr + RPAR

statement.setName("execute stmt")

#statement.ignore(pythonComment)

for tokens in statement.searchString(sample):

print ' '.join(tokens.asList())

这将扫描以下示例：

^{pr2}$

并报告这些不安全的声明：cursor.execute ( "SELECT * FROM TEST WHERE ID = '%s' -- UNSAFE" % id )

cursor.execute ( "SELECT * FROM TEST WHERE ID = '" + id + "' -- UNSAFE" )

cursor.execute ( sqlVar + " -- UNSAFE" )

cursor.execute ( "SELECT * FROM TEST " "WHERE ID = " + "'%s' -- UNSAFE" % name )

您也可以让pyparsing报告找到的行的位置，使用scanString而不是searchString。在