The clause, expression, or query to strip literals from
The input with every complete string literal removed. An UNTERMINATED literal is left in place on purpose: the stray quote and everything after it stay visible to the denylist rather than being silently swallowed.
Removes SQL string literals from a clause or expression so that a keyword denylist can be applied to the code portion without tripping over keywords that appear inside quoted data (e.g.
Comments LIKE '%--%').🚨 SECURITY — this is the single implementation of literal-stripping for MJ's SQL screens, and it MUST stay byte-for-byte consistent with how the database parses literals. If the stripper removes a span the database does NOT treat as a literal, everything hidden inside that span bypasses the denylist while the database still executes it.
An earlier version of this logic (duplicated in two places, which is how it survived) honored backslash escaping —
/(['"])(?:(?=(\\?))\2[\s\S])*?\1/g. SQL Server and PostgreSQL do not treat\as an escape character, sox = 'a\') ; DROP TABLE Users; --'was swallowed whole as one "literal" and stripped tox =, which passed every denylist — while the database closed the literal at the real quote and executed the stacked statement.Do NOT reintroduce backslash-escape handling here, and do NOT inline a second copy of this regex anywhere else — call this function.