# SQL Injection Detection - Detects SQL injection attempts in prompts
# Uses conditional logic: BLOCK if an identifier word + block word appear in same sentence
# NOTE: avoid regex-special characters like ( ) [ ] in keywords,
# because the content filter matches keywords via regex internally.
category_name: "prompt_injection_sql"
description: "Detects SQL injection attempts embedded in prompts"
default_action: "BLOCK"

# IDENTIFIER WORDS - SQL keywords that could be used in injection
# When combined with block words, triggers blocking
identifier_words:
  - "SELECT"
  - "INSERT"
  - "UPDATE"
  - "DELETE"
  - "DROP"
  - "ALTER"
  - "CREATE"
  - "EXEC"
  - "EXECUTE"
  - "TRUNCATE"
  - "GRANT"
  - "REVOKE"
  - "UNION"
  - "SHUTDOWN"

# ADDITIONAL BLOCK WORDS - Injection-specific patterns
additional_block_words:
  - "1=1"
  - "OR true"
  - "OR 1"
  - "--"
  - "xp_cmdshell"
  - "information_schema"
  - "sys.tables"
  - "sysobjects"
  - "pg_catalog"
  - "pg_tables"
  - "INTO OUTFILE"
  - "INTO DUMPFILE"
  - "LOAD_FILE"
  - "BENCHMARK"
  - "WAITFOR"
  - "HAVING 1=1"
  - "ORDER BY 1"
  - "schema_name"
  - "@@version"
  - "drop table"
  - "drop database"
  - "drop schema"
  - "truncate table"
  - "delete from"
  - "alter table"
  - "union select"
  - "union all select"
  - "grant all"

# ALWAYS BLOCK - Explicit SQL injection patterns (blocked regardless of context)
always_block_keywords:
  - keyword: "'; DROP TABLE"
    severity: "high"
  - keyword: "'; DELETE FROM"
    severity: "high"
  - keyword: "' OR '1'='1"
    severity: "high"
  - keyword: "' OR 1=1--"
    severity: "high"
  - keyword: "' OR 1=1 --"
    severity: "high"
  - keyword: "UNION SELECT * FROM"
    severity: "high"
  - keyword: "UNION ALL SELECT"
    severity: "high"
  - keyword: "'; EXEC xp_cmdshell"
    severity: "high"
  - keyword: "1; DROP TABLE"
    severity: "high"
  - keyword: "' UNION SELECT NULL"
    severity: "high"
  - keyword: "' UNION SELECT"
    severity: "high"
  - keyword: "UNION SELECT NULL"
    severity: "high"
  - keyword: "SELECT password FROM"
    severity: "high"
  - keyword: "DELETE FROM users"
    severity: "high"
  - keyword: "DROP DATABASE"
    severity: "high"
  - keyword: "DROP TABLE users"
    severity: "high"
  - keyword: "' OR ''='"
    severity: "high"
  - keyword: "admin'--"
    severity: "high"
  - keyword: "1' OR '1'='1"
    severity: "high"
  - keyword: "INFORMATION_SCHEMA.TABLES"
    severity: "high"
  - keyword: "INFORMATION_SCHEMA.COLUMNS"
    severity: "high"
  - keyword: "INTO OUTFILE"
    severity: "high"
  - keyword: "INTO DUMPFILE"
    severity: "high"
  - keyword: "LOAD_FILE"
    severity: "high"
  - keyword: "WAITFOR DELAY"
    severity: "high"
  - keyword: "'; SHUTDOWN --"
    severity: "high"
  - keyword: "'; EXEC sp_"
    severity: "high"
  - keyword: "xp_cmdshell"
    severity: "high"
  - keyword: "sp_addlogin"
    severity: "high"
  - keyword: "sp_addsrvrolemember"
    severity: "high"
  - keyword: "ORDER BY 1--"
    severity: "high"
  - keyword: "GROUP BY 1--"
    severity: "high"
  - keyword: "HAVING 1=1"
    severity: "high"

# Exception patterns (legitimate uses)
exceptions:
  - "SQL tutorial"
  - "learn SQL"
  - "explain SQL"
  - "what is SQL injection"
  - "SQL syntax"
  - "SQL documentation"
  - "database design"
  - "SQL best practices"
  - "SQL injection prevention"
  - "protect against SQL injection"
  - "how to prevent"
  - "how to protect"
  - "how to defend"
  - "parameterized query"
  - "parameterized queries"
  - "prepared statement"
  - "prepared statements"
  - "SQL training"
  - "database course"
  - "how to sanitize"
  - "how to validate"
  - "research on"
  - "security research"
  - "security audit"
  - "penetration testing"
