Automattic\WooCommerce\Blueprint\Importers

ImportRunSql::contains_suspicious_comments │ private │ WC 1.0

Check for suspicious comment patterns that might hide malicious code.

This method detects various types of SQL comments that might be used to hide malicious SQL commands or bypass security filters.

Метод класса: ImportRunSql{}

Хуков нет.

Возвращает

bool. True if suspicious comments found, false otherwise.

Использование

// private - только в коде основоного (родительского) класса
$result = $this->contains_suspicious_comments( $sql_content ): bool;
$sql_content(строка) (обязательный)
The SQL query to check.

Код ImportRunSql::contains_suspicious_comments() WC 11.2.2

woocommerce/packages/blueprint/src/Importers/ImportRunSql.php 
private function contains_suspicious_comments( string $sql_content ): bool {
	// Quick check if there are any comments at all before running regex.
	if (
		strpos( $sql_content, '--' ) === false &&
		strpos( $sql_content, '/*' ) === false &&
		strpos( $sql_content, '#' ) === false
	) {
		return false;
	}

	// List of potentially dangerous SQL commands to check for in comments.
	$dangerous_commands = array(
		'DELETE',
		'DROP',
		'ALTER',
		'CREATE',
		'TRUNCATE',
		'GRANT',
		'REVOKE',
		'EXEC',
		'EXECUTE',
		'CALL',
		'INTO OUTFILE',
		'INTO DUMPFILE',
		'LOAD_FILE',
		'LOAD DATA',
		'BENCHMARK',
		'SLEEP',
		'INFORMATION_SCHEMA',
		'USER\\(',
		'DATABASE\\(',
		'SCHEMA\\(',
	);

	$dangerous_pattern = implode( '|', $dangerous_commands );

	// Check for SQL comments that might be hiding malicious code.
	$patterns = array(
		// Single-line comments (-- style) containing dangerous commands.
		'/--.*?(' . $dangerous_pattern . ')/i',
		// Single-line comments (# style) containing dangerous commands.
		'/#.*?(' . $dangerous_pattern . ')/i',
		// Multi-line comments hiding dangerous commands.
		'/\/\*.*?(' . $dangerous_pattern . ').*?\*\//is',
		// MySQL-specific execution comments (version-specific code execution).
		'/\/\*![0-9]*.*?\*\//',
	);

	foreach ( $patterns as $pattern ) {
		if ( preg_match( $pattern, $sql_content ) ) {
			return true;
		}
	}
	return false;
}