red-team

name	red-team
description	SQL injection and input validation audit for the DuckHog SQL proxy pipeline. Systematically tests all paths where user-supplied identifiers or values flow into rewritten SQL strings. Use as a routine security check after modifying any rewriter, serializer, or SQL-generation code.

Red Team — SQL Injection Audit

Purpose

DuckHog rewrites user SQL and forwards it to a remote database over Arrow Flight. Every rewriter is a potential injection surface. This skill systematically probes all paths where user input flows into generated SQL strings.

Invariant

All user-supplied identifiers MUST pass through KeywordHelper::WriteOptionallyQuoted() and all values through Value::ToSQLString(). Any path that performs raw string concatenation with user input is a vulnerability.

Attack Surfaces

Surface	Entry point	What to probe
INSERT serialization	posthog_sql_utils.cpp:BuildInsertSQL	Value escaping: ', '', \, NULL bytes, overlong UTF-8, nested quotes in LIST/STRUCT
DELETE rewriter	posthog_dml_rewriter.cpp	Table/schema names, WHERE clause expressions, USING clause refs
UPDATE rewriter	posthog_dml_rewriter.cpp	SET expressions, FROM clause refs, subqueries
MERGE rewriter	posthog_dml_rewriter.cpp	Source table refs, ON clause, WHEN expressions
View rewriter	posthog_view_rewriter.cpp	View name, schema, column aliases, query body