# SQL Injection Detection — Keyword-Based Policy Template
# Uses conditional matching: identifier_words + additional_block_words
# Same pattern as Prompt Injection template.
category_name: "sql_injection"
description: "Detects SQL injection attempts via keyword matching"
default_action: "BLOCK"

# IDENTIFIER WORDS — SQL keywords that signal a database operation
identifier_words:
  - "select"
  - "drop"
  - "union"
  - "delete"
  - "exec"
  - "insert"
  - "truncate"
  - "grant"
  - "alter"
  - "update"

# ADDITIONAL BLOCK WORDS — when combined with identifier words, triggers blocking
additional_block_words:
  - "or 1=1"
  - "drop table"
  - "union select"
  - "delete from"
  - "'; exec"
  - "into outfile"
  - "truncate table"
  - "grant all"
  - "' or ''='"
  - "'; shutdown"
  - "xp_cmdshell"
  - "sp_addlogin"
  - "sp_oacreate"
  - "information_schema"
  - "load_file"
  - "waitfor delay"
  - "benchmark"

# ALWAYS BLOCK — explicit injection phrases (blocked regardless of context)
always_block_keywords:
  - keyword: "' or 1=1"
    severity: "high"
  - keyword: "'; drop table"
    severity: "high"
  - keyword: "union select null"
    severity: "high"
  - keyword: "' or ''='"
    severity: "high"
  - keyword: "'; shutdown"
    severity: "high"
  - keyword: "'; exec xp_cmdshell"
    severity: "high"
  - keyword: "information_schema.tables"
    severity: "high"
  - keyword: "information_schema.columns"
    severity: "high"
  - keyword: "into outfile"
    severity: "high"
  - keyword: "load_file"
    severity: "high"
  - keyword: "' union select"
    severity: "high"
  - keyword: "waitfor delay"
    severity: "high"
  - keyword: "benchmark"
    severity: "medium"

# EXCEPTIONS — legitimate use cases
exceptions:
  - "what is"
  - "explain"
  - "how to prevent"
  - "how to protect"
  - "how do companies defend"
  - "how to sanitize"
  - "research on"
  - "study on"
  - "academic"
  - "security class"
  - "best practices"
  - "security research"
  - "penetration testing"
  - "security audit"
