Repository navigation

FIX: Detect obfuscated SQL injection and javascript: payloads in output scorers - #3640

Merged

Roman Lutz (romanlutz) merged 9 commits into

microsoft:mainfrom

shashank03-dev:fix/sql-xss-scorer-obfuscation

Nov 2, 2026

Merged

FIX: Detect obfuscated SQL injection and javascript: payloads in output scorers#3640
Roman Lutz (romanlutz) merged 9 commits into
microsoft:mainfrom
shashank03-dev:fix/sql-xss-scorer-obfuscation

Commits on Oct 29, 2026
- FIX: Detect comment-separated UNION and OR tautology bypasses in SQLInjectionOutputScorer
  Dev3 ^~^ (shashank03-dev)
  committed
  7cbad48
- FIX: Detect character-reference and control-character javascript: URIs in XSSOutputScorer
  Dev3 ^~^ (shashank03-dev)
  committed
  081adc1
Commits on Nov 1, 2026
- FIX: Bound JavaScript URI backtracking and tighten tautology value checks
  Dev3 ^~^ (shashank03-dev)
  committed
  42af6d9
- FIX: Match tautology values and UNION line comments by SQL token rules
  Dev3 ^~^ (shashank03-dev)
  committed
  cc44a4e
Commits on Nov 2, 2026
- Merge upstream main into SQL and XSS scorer fixes
  
  Roman Lutz (romanlutz)
  and
  Copilot
  committed
  c2d75f5
- FIX: Preserve SQL line-comment rules across dialects
  
  Roman Lutz (romanlutz)
  and
  Copilot
  committed
  d0e3ffe
- Merge upstream main to refresh SQL scorer PR checks
  
  Roman Lutz (romanlutz)
  and
  Copilot
  committed
  0d162dd
- FIX: Respect HTML attribute boundaries in JavaScript URI scoring
  
  Roman Lutz (romanlutz)
  and
  Copilot
  committed
  4f1bfd9
- Merge upstream main after scorer review fixes
  
  Roman Lutz (romanlutz)
  and
  Copilot
  committed
  13fd20d