Trim user input before sending to detectSQLInjection

[bitterpanda63]

Trims and normalizes user input before SQL injection detection, matching the fix applied to the Java firewall in AikidoSec/firewall-java#298.

Problem: An attacker can pad their payload with trailing whitespace (e.g. "payload "). If the DB driver trims this before execution, the SQL query won't contain the padded input, causing shouldReturnEarly to incorrectly return true (missed detection).

Fix: Apply .toLowerCase().trim() to the user input before both the early-return check and the WASM detection call.

See: AikidoSec/firewall-java#298

Summary by Aikido

Security Issues: 0	Quality Issues: 0	Resolved Issues: 0

🐛 Bugfixes

• Normalized and trimmed user input before detection and early-return check

^{More info}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!