6 ms·

I feel like I've seen plenty of non-AI, pre-2020 SAST tools catch SQLis like the one mentioned here, and if nothing else, then a code review ought to catch it.

I feel like I've seen plenty of non-AI, pre-2020 SAST tools catch SQLis like the one mentioned here, and if nothing else, then a code review ought to catch it. Is WordPress not using code reviews and/or SAST?

f311a 2mo ago
They would not catch it, it requires combining multiple vulns.
- lillesvin 2mo ago
  I just meant the SQLi (which is the basis of the chain), not the full chain.
  - StrauXX 2mo ago
    There is likely thousands of such SQL concatenations throughout the codebase. The issue with traditional SAST tools is that they can't readon about context.