Systems and methods for SQL query constraint solving
The present invention relates to systems and methods for analyzing SQL queries for constraint violations, which may indicate injection attacks. The systems and methods tokenize a SQL query to generate a token stream. Next, lexical nodes are generated by iterating over the token stream. Then, a parse tree can be constructed by iterating over the lexical nodes. The parse tree may be compared to a SQL schema and access configuration for a database in order to analyze the SQL query for constraint violations, including determining the number of queries in the parse tree, identifying invalid fields and table access, identifying invalid field type comparisons and pattern matches, and identifying early statement termination.
1. A computerized method for analyzing SQL queries for constraint violations comprising:
tokenizing a SQL query to generate a token stream;
generating lexical nodes by iterating over the token stream to chunk into SQL commands, SQL functions and field/table identifiers;
constructing a parse tree by iterating over the lexical nodes;
analyzing, using a processor, the parse tree for constraint violations by comparing the parse tree to a SQL schema and access configuration for a database, wherein the analyzing includes identifying invalid fields and table access, wherein identifying invalid fields and table access comprises identifying parse tree identifiers for fields or tables that do not exist or for which access is restricted; and
performing risk mitigation for SQL queries that are likely harboring an SQL injection attack.
2. The method of claim 1 , wherein the analyzing includes determining the number of queries in the parse tree.
3. The method of claim 2 , further comprising at least one of identifying multiple SQL statements, delineating by a query separator, and identifying sub-queries.
4. The method of claim 1 , wherein the analyzing includes identifying invalid field type comparisons and pattern matches.
5. The method of claim 4 , wherein identifying invalid field type comparisons and pattern matches comprises identifying where the field input mismatches the SQL query function, or where field are compared by the SQL query which are restricted from being compared by the access configuration.
6. The method of claim 1 , wherein the analyzing includes identifying early statement termination.
7. The method of claim 1 , further comprising outputting a report of the analysis.
8. A system for analyzing SQL queries for constraint violations comprising:
a processor executing computer readable medium to:
tokenize a SQL query to generate a token stream;
generate lexical nodes by iterating over the token stream to chunk into SQL commands, SQL functions and field/table identifiers;
construct a parse tree by iterating over the lexical nodes;
analyze the parse tree for constraint violations by comparing the parse tree to a SQL schema and access configuration for a database, wherein the query constraint solver is further configured to identify invalid fields and table access, wherein identifying invalid fields and table access comprises identifying parse tree identifiers for fields or tables that do not exist or for which access is restricted; and
perform risk mitigation for SQL queries that are likely harboring an SQL injection attack.
9. The system of claim 8 , wherein the query constraint solver is further configured to determine the number of queries in the parse tree.
10. The system of claim 9 , the query constraint solver is further configured to identify multiple SQL statements, delineate by a query separator, and identify sub-queries.
11. The system of claim 8 , wherein the query constraint solver is further configured to identify invalid field type comparisons and pattern matches.
12. The system of claim 11 , wherein identifying invalid field type comparisons and pattern matches comprises identifying where the field input mismatches the SQL query function, or where field are compared by the SQL query which are restricted from being compared by the access configuration.
13. The system of claim 8 , wherein the query constraint solver is further configured to identify early statement termination.
14. The system of claim 8 , the query constraint solver is further configured to output a report of the analysis.