SQL Injection related apps!!

[ehsanedalat]

Hi,

Is there any app in this repository with SQL injection flaw related to SQLite database??

Thanks
Ehsan

[ehsanedalat]

@Alexandre-Bartel @nguyenLisa @JulianSchuette @lilicoding @ericbodden @StevenArzt

[MarcMil]

Not that I know of. But in my opinion, this would not really add anything. Note that in order to detect SQL injections, the data flow analysis needs to recognize user/attacker input as sources and SQL statements as sinks; this is merely a configuration issue.
DroidBench focuses on data tracking challenges such as taint tracking over collections. When a taint tracking tool does not support collection API they loose the taint when the data is added to a list and then retrieved from the list.

Note that these challenges are independent of the tool's sources and sinks. Basically you should be able to use any decent data tracking tool (that hopefully is able to get a lot of DroidBench test cases correct) such as as FlowDroid and plug-in the source and sinks for your particular problem.