Skip to content

Trim user input before sending to detectSQLInjection#456

Merged
bitterpanda63 merged 1 commit into
mainfrom
fix/trim-user-input-sql-injection
Jun 1, 2026
Merged

Trim user input before sending to detectSQLInjection#456
bitterpanda63 merged 1 commit into
mainfrom
fix/trim-user-input-sql-injection

Conversation

@bitterpanda63
Copy link
Copy Markdown
Member

@bitterpanda63 bitterpanda63 commented Jun 1, 2026

Trims leading/trailing whitespace from user input before SQL injection detection, matching the fix applied to the Java firewall in AikidoSec/firewall-java#298.

Problem: An attacker can pad their payload with trailing whitespace (e.g. "payload "). If the DB driver trims this before execution, the SQL query won't contain the padded input, causing shouldReturnEarly to incorrectly return true (missed detection).

Fix: Apply strings.TrimSpace after strings.ToLower for the user input before both the early-return check and the zen-internals detection call.

See: AikidoSec/firewall-java#298

Summary by Aikido

Security Issues: 0 Quality Issues: 0 Resolved Issues: 0

🐛 Bugfixes

  • Trimmed user input whitespace before SQL injection detection logic

More info

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@bitterpanda63 bitterpanda63 merged commit 0b104c3 into main Jun 1, 2026
24 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants