Avoid False-Positive reports of SQL Injection attacks from Azure Databricks
We are receiving false-positive reports of SQL Injection attacks based on enclosing a candidate SQL statement into a sub-query and adding a "where 1=0" clause when using Azure Databricks. These reports cannot be ignored and Administrator time is wasted in reviewing these. If the connection was correctly identified, and not simply marked as "Microsoft JDBC Driver for SQL Server" or some filtering method was available, this could be avoided.
Tomer Rotstein commented
We're currently investigating this issue. I will update when we have more information to share.