Description

This detector identifies SQL injection vulnerabilities in Elixir applications that use MySQL database connections. It flags SQL queries that are dynamically constructed with user-controlled data or variables that can lead to unauthorized database access or manipulation.

Detection Strategy

• Method calls to MySQL SQL execution functions are identified (such as query execution methods in Elixir MySQL libraries)

• For each SQL method call, the detector locates the SQL query parameter - checking the first parameter for piped calls or the second parameter for regular function calls

• The SQL query parameter is analyzed to determine if it contains dynamic content that could be dangerous, such as string concatenation with variables or interpolation

• A vulnerability is reported when a SQL execution method contains a query parameter that is constructed unsafely with potentially user-controlled data

Vulnerable code example

defmodule MyApp do
  def vulnerable_query(_conn, _opts) do
    user_id = "1"
    
    # VULNERABLE: SQL injection via string concatenation in WHERE clause
    query = "SELECT * FROM users WHERE id = " <> user_id
    
    MyXQL.query!(MyApp.DB, query, [])...

✅ Secure code example

defmodule MyApp do
  def secure_query(_conn, _opts) do
    user_id = "1"
    
    # SAFE: uses parameterized query instead of string concatenation
    query = "SELECT * FROM users WHERE id = ?"
    
    MyXQL.query!(MyApp.DB, query, [user_id])...