lib/contrast/agent/protect/rule/no_sqli.rb in contrast-agent-3.10.2 vs lib/contrast/agent/protect/rule/no_sqli.rb in contrast-agent-3.11.0
- old
+ new
@@ -1,11 +1,10 @@
# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
# frozen_string_literal: true
-# This could be useful for making patterns maybe?
-# https://github.com/cr0hn/nosqlinjection_wordlists
-# https://www.owasp.org/index.php/Testing_for_NoSQL_injection
+cs__scoped_require 'contrast/agent/protect/rule/base_service'
+
module Contrast
module Agent
module Protect
module Rule
# The Ruby implementation of the Protect NoSQL Injection rule.
@@ -68,10 +67,11 @@
if potential_attack_string
# We need the query hash to be a JSON string to match on JSON input attacks
begin
potential_attack_string = JSON.generate(potential_attack_string).to_s
rescue JSON::GeneratorError
- logger.debug("Error in JSON::generate from input #{ potential_attack_string }")
+ logger.trace('Error in JSON::generate', input: potential_attack_string)
+ nil
end
end
super(context, potential_attack_string, **kwargs)
end