gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 37018: Regression tests 

This patch adds regression tests. With the current codebase, the
malicious query returns a 200. It should be caught and a 400 needs to be
returned.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/query.t
=> FAIL: It returns a 200
3. Once the rest of the patches are ready, repeat 2
=> SUCCESS: It returns a 400

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Tomas Cohen Arazi 2024-07-06 10:32:07 -03:00 committed by Lucas Gass
parent 3900bba48e
commit 194f48ab55
1 changed files with 28 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
t/db_dependent/api/v1/query.t
View File

@ -17,7 +17,7 @@
use Modern::Perl;
use Test::More tests => 2;
use Test::More tests => 3;
use Test::Mojo;
use t::lib::TestBuilder;
@ -148,3 +148,30 @@ subtest 'x-koha-embed tests' => sub {
$schema->storage->txn_rollback;
};
subtest 'SQL injection in "query" handling' => sub {
plan tests => 2;
$schema->storage->txn_begin;
my $librarian = $builder->build_object(
{
class => 'Koha::Patrons',
value => { flags => 1 } # superlibrarian
}
);
my $password = 'thePassword123';
$librarian->set_password( { password => $password, skip_validation => 1 } );
my $userid = $librarian->userid;
my $patron_id = $builder->build_object( { class => 'Koha::Patrons' } )->id;
my $q =
"[{\"-and\":[[{\"me.patron_id\":{\"like(IF(ASCII(SUBSTRING((SELECT version()),1,1))=ASCII('1'),SLEEP(1/100000),0))or\":\"\%a\%\"}}]]}]";
$t->get_ok("//$userid:$password@/api/v1/patrons?q=$q")
->status_is( 400, 'Attempt to inject SQL through operators is rejected' );
$schema->storage->txn_rollback;
};