SQL Injection Detection

Fields Scanned

SQL injection scanning targets configuration fields that are executed against data sources at runtime:

Detection Rules

What Is Allowed

Safe SQL patterns that will not trigger findings:

// ALLOWED — Parameterized query with named parameters:
SELECT id, name, department FROM employees WHERE tenantId = @tenantId AND status = @status

// ALLOWED — Parameterized INSERT:
INSERT INTO audit_log (tenantId, action, actorId, timestamp)
VALUES (@tenantId, @action, @actorId, GETUTCDATE())

// ALLOWED — Filtered SELECT with explicit columns:
SELECT e.id, e.name, d.name AS department
FROM employees e
INNER JOIN departments d ON e.departmentId = d.id
WHERE e.tenantId = @tenantId AND e.isActive = 1

What Triggers Failure

// FAIL — UNION attack:
SELECT id FROM employees WHERE name = 'x' UNION SELECT password FROM admin_users--

// FAIL — DROP TABLE:
SELECT 1; DROP TABLE employees;--

// FAIL — Dynamic string concatenation (not parameterized):
"SELECT * FROM " + userInput + " WHERE id = " + userId

// FAIL — TRUNCATE:
TRUNCATE TABLE process_executions; SELECT 1

Scan Finding Example

{
  "check":        "SqlInjection",
  "result":       "FAIL",
  "severity":     "Critical",
  "findings": [
    {
      "artifactType": "ProcessDefinition",
      "artifactName": "DataExtractionFlow",
      "field":        "nodes[4].config.query",
      "value":        "SELECT * FROM employees WHERE name = '' UNION SELECT password, salt, '' FROM admin_credentials--",
      "rule":         "UnionAttack",
      "message":      "SQL query contains a UNION SELECT pattern. This is a critical SQL injection indicator — the query has been flagged for review."
    }
  ]
}

Legitimate Use of SQL Nodes

SQL-capable workflow nodes are designed for parameterized queries only. The workflow runtime enforces parameterization — direct string interpolation in queries is not supported by the execution engine. If a package contains raw string concatenation in a query field, it indicates either a poorly designed package or a deliberate injection attempt. Both are blocked.