Initial commit

hooks/scripts/check-sql-injection.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CLAUDE_MARKETPLACE_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
+
+source "${CLAUDE_MARKETPLACE_ROOT}/marketplace-utils/hook-lifecycle.sh"
+
+init_hook "prisma-6" "PreToolUse"
+
+INPUT=$(read_hook_input)
+
+if ! command -v grep &> /dev/null; then
+  log_error "grep command not found"
+  pretooluse_respond "allow"
+  finish_hook 0
+fi
+
+TS_FILES=$(find . -type f \( -name "*.ts" -o -name "*.tsx" -o -name "*.js" -o -name "*.jsx" \) \
+  ! -path "*/node_modules/*" \
+  ! -path "*/dist/*" \
+  ! -path "*/build/*" \
+  ! -path "*/.next/*" 2>/dev/null || true)
+
+if [ -z "$TS_FILES" ]; then
+  pretooluse_respond "allow"
+  finish_hook 0
+fi
+
+UNSAFE_QUERY_RAW=$(echo "$TS_FILES" | xargs grep -n --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx" '\$queryRawUnsafe' 2>/dev/null || true)
+
+if [ -n "$UNSAFE_QUERY_RAW" ]; then
+  log_error "Unsafe raw SQL query detected - SQL injection risk"
+  pretooluse_respond "block" "Warning: Unsafe raw SQL query detected - SQL injection risk
+
+Use \$queryRaw with tagged template syntax instead:
+  ✗ prisma.\$queryRawUnsafe(\`SELECT * FROM User WHERE id = \${id}\`)
+  ✓ prisma.\$queryRaw\`SELECT * FROM User WHERE id = \${id}\`"
+  finish_hook 0
+fi
+
+RAW_WITH_INTERPOLATION=$(echo "$TS_FILES" | xargs grep -n --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx" 'Prisma\.raw(' 2>/dev/null | \
+  grep -E '\$\{|\+.*["\`]' || true)
+
+if [ -n "$RAW_WITH_INTERPOLATION" ]; then
+  log_error "Prisma.raw() with string interpolation - SQL injection risk"
+  pretooluse_respond "block" "Warning: Prisma.raw() with string interpolation - SQL injection risk
+
+Use Prisma.sql with tagged template syntax:
+  ✗ Prisma.raw(\`WHERE id = \${id}\`)
+  ✓ Prisma.sql\`WHERE id = \${id}\`"
+  finish_hook 0
+fi
+
+MISSING_TAGGED_TEMPLATE=$(echo "$TS_FILES" | xargs grep -n --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx" '\$queryRaw(' 2>/dev/null || true)
+
+if [ -n "$MISSING_TAGGED_TEMPLATE" ]; then
+  log_warn "\$queryRaw with function call syntax instead of tagged template"
+  pretooluse_respond "allow" "Warning: \$queryRaw with function call syntax instead of tagged template
+
+Use tagged template syntax for automatic parameterization:
+  ✗ prisma.\$queryRaw(Prisma.sql\`...\`)
+  ✓ prisma.\$queryRaw\`...\`"
+  finish_hook 0
+fi
+
+EXECUTE_RAW_UNSAFE=$(echo "$TS_FILES" | xargs grep -n --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx" '\$executeRawUnsafe' 2>/dev/null || true)
+
+if [ -n "$EXECUTE_RAW_UNSAFE" ]; then
+  log_error "Unsafe raw SQL execution detected - SQL injection risk"
+  pretooluse_respond "block" "Warning: Unsafe raw SQL execution detected - SQL injection risk
+
+Use \$executeRaw with tagged template syntax instead:
+  ✗ prisma.\$executeRawUnsafe(\`UPDATE User SET name = '\${name}'\`)
+  ✓ prisma.\$executeRaw\`UPDATE User SET name = \${name}\`"
+  finish_hook 0
+fi
+
+pretooluse_respond "allow"
+finish_hook 0