Secure CodingRules
detect-llm-generated-sql
Detect dangerous LLM-to-SQL patterns.
Detect dangerous LLM-to-SQL patterns.
OWASP LLM Top 10 2025: LLM05 - Improper Output Handling
CWE: CWE-89
Severity: 🔴 Critical
Error Message Format
The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
🔒 CWE-89 OWASP:A05 CVSS:9.8 | SQL Injection detected | CRITICAL [SOC2,PCI-DSS,HIPAA,ISO27001]
Fix: Review and apply the recommended fix | https://owasp.org/Top10/A05_2021/Message Components
| Component | Purpose | Example |
|---|---|---|
| Risk Standards | Security benchmarks | CWE-89 OWASP:A05 CVSS:9.8 |
| Issue Description | Specific vulnerability | SQL Injection detected |
| Severity & Compliance | Impact assessment | CRITICAL [SOC2,PCI-DSS,HIPAA,ISO27001] |
| Fix Instruction | Actionable remediation | Follow the remediation steps below |
| Technical Truth | Official reference | OWASP Top 10 |
Rule Details
Identifies LLM-generated SQL being executed directly without validation.
❌ Incorrect
await db.query(llmSQL);
await db.execute(llmQuery);
await db.raw(generatedSQL);✅ Correct
// Use ORM
const users = await User.findAll();
// Validate SQL
const validated = validateSQL(llmQuery, allowedTables);
await db.query(validated);Options
{
"secure-coding/detect-llm-generated-sql": ["error"]
}Best Practices
- Use ORM (Prisma, TypeORM, Sequelize)
- Validate SQL structure against allowlist
- Parse and analyze SQL AST before execution
Version
Introduced in v2.3.0
Known False Negatives
The following patterns are not detected due to static analysis limitations:
Query from Variable
Why: Query strings from variables not traced.
// ❌ NOT DETECTED - Query from variable
const query = `SELECT * FROM users WHERE id = ${userId}`;
db.execute(query);Mitigation: Always use parameterized queries.
Custom Query Builders
Why: Custom ORM/query builders not recognized.
// ❌ NOT DETECTED - Custom builder
customQuery.where(userInput).execute();Mitigation: Review all query builder patterns.
Template Engines
Why: Template-based queries not analyzed.
// ❌ NOT DETECTED - Template
executeTemplate('query.sql', { userId });Mitigation: Validate all template variables.