scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-04 02:31:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 70

add SQL injection detection guardrail category

Browse source
This commit is contained in:
Ishaan Jaffer 2026-02-17 20:27:55 -08:00
parent 5946a933a0
commit 4f754f68c9
1 changed files with 120 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

120
litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/categories/prompt_injection_sql.yaml Normal file
View file

@ -0,0 +1,120 @@
# SQL Injection Detection - Detects SQL injection attempts in prompts
# Uses conditional logic: BLOCK if an identifier word + block word appear in same sentence
category_name: "prompt_injection_sql"
description: "Detects SQL injection attempts embedded in prompts"
default_action: "BLOCK"
# IDENTIFIER WORDS - SQL keywords that could be used in injection
# When combined with block words, triggers blocking
identifier_words:
- "SELECT"
- "INSERT"
- "UPDATE"
- "DELETE"
- "DROP"
- "ALTER"
- "CREATE"
- "EXEC"
- "EXECUTE"
- "TRUNCATE"
- "GRANT"
- "REVOKE"
# ADDITIONAL BLOCK WORDS - Injection-specific patterns
additional_block_words:
- "UNION"
- "1=1"
- "OR true"
- "OR 1"
- "--"
- "/*"
- "xp_cmdshell"
- "information_schema"
- "sys.tables"
- "INTO OUTFILE"
- "LOAD_FILE"
- "BENCHMARK"
- "SLEEP("
- "WAITFOR"
- "HAVING 1=1"
- "GROUP BY"
- "ORDER BY 1"
- "INTO DUMPFILE"
- "hex("
- "char("
- "concat("
- "@@version"
- "schema_name"
# ALWAYS BLOCK - Explicit SQL injection patterns (blocked regardless of context)
always_block_keywords:
- keyword: "'; DROP TABLE"
severity: "high"
- keyword: "'; DELETE FROM"
severity: "high"
- keyword: "' OR '1'='1"
severity: "high"
- keyword: "' OR 1=1--"
severity: "high"
- keyword: "UNION SELECT * FROM"
severity: "high"
- keyword: "UNION ALL SELECT"
severity: "high"
- keyword: "'; EXEC xp_cmdshell"
severity: "high"
- keyword: "1; DROP TABLE"
severity: "high"
- keyword: "' UNION SELECT NULL"
severity: "high"
- keyword: "SELECT * FROM users"
severity: "medium"
- keyword: "SELECT password FROM"
severity: "high"
- keyword: "INSERT INTO users"
severity: "medium"
- keyword: "UPDATE users SET"
severity: "medium"
- keyword: "DELETE FROM users"
severity: "high"
- keyword: "DROP DATABASE"
severity: "high"
- keyword: "DROP TABLE users"
severity: "high"
- keyword: "ALTER TABLE users"
severity: "medium"
- keyword: "' OR ''='"
severity: "high"
- keyword: "admin'--"
severity: "high"
- keyword: "1' OR '1'='1"
severity: "high"
- keyword: "INFORMATION_SCHEMA.TABLES"
severity: "high"
- keyword: "INFORMATION_SCHEMA.COLUMNS"
severity: "high"
- keyword: "LOAD DATA INFILE"
severity: "high"
- keyword: "INTO OUTFILE"
severity: "high"
- keyword: "BENCHMARK(10000000"
severity: "high"
- keyword: "WAITFOR DELAY"
severity: "high"
- keyword: "SLEEP(5)"
severity: "medium"
# Exception patterns (legitimate uses)
exceptions:
- "SQL tutorial"
- "learn SQL"
- "explain SQL"
- "SQL syntax"
- "SQL documentation"
- "database design"
- "SQL best practices"
- "SQL injection prevention"
- "protect against SQL injection"
- "parameterized query"
- "prepared statement"
- "SQL training"
- "database course"