Bugzilla – Attachment 166872 Details for
Bug 36875
SQL injection in additional content pages
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36875: Unit test
Bug-36875-Unit-test.patch (text/plain), 2.22 KB, created by
Marcel de Rooy
on 2024-05-17 08:59:02 UTC
(
hide
)
Description:
Bug 36875: Unit test
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2024-05-17 08:59:02 UTC
Size:
2.22 KB
patch
obsolete
>From 9185f508dbe1883bdc89305c1c455229c7779fb5 Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Thu, 16 May 2024 08:41:19 +0000 >Subject: [PATCH] Bug 36875: Unit test >Content-Type: text/plain; charset=utf-8 > >Test plan: >Run Koha/AdditionalContents.t without next patch. >Should fail on the sleep execution. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > t/db_dependent/Koha/AdditionalContents.t | 36 ++++++++++++++++++++++-- > 1 file changed, 34 insertions(+), 2 deletions(-) > >diff --git a/t/db_dependent/Koha/AdditionalContents.t b/t/db_dependent/Koha/AdditionalContents.t >index 565b3fe3f8..85fc4f3a53 100755 >--- a/t/db_dependent/Koha/AdditionalContents.t >+++ b/t/db_dependent/Koha/AdditionalContents.t >@@ -19,7 +19,7 @@ > > use Modern::Perl; > >-use Test::More tests => 6; >+use Test::More tests => 7; > use Test::Exception; > > use Koha::AdditionalContents; >@@ -328,4 +328,36 @@ subtest 'find_best_match' => sub { > # Note: find_best_match is tested further via $libary->opac_info; see t/db_dependent/Koha/Library.t > > $schema->storage->txn_rollback; >- } >+}; >+ >+subtest '->translated_content' => sub { >+ plan tests => 4; >+ >+ $schema->storage->txn_begin; >+ >+ my $library = $builder->build_object( { class => 'Koha::Libraries' } ); >+ my $page = $builder->build_object( >+ { >+ class => 'Koha::AdditionalContents', >+ value => { category => 'pages', branchcode => undef }, >+ } >+ ); >+ $page->translated_contents( >+ [ >+ { title => 'T', content => 'C1', lang => 'default' }, >+ { title => 'T', content => 'C2', lang => 'nl-NL' }, >+ { title => 'T', content => 'C3', lang => 'de' }, >+ ] >+ ); >+ is( $page->translated_content('nl-NL')->content, 'C2', 'Found translation' ); >+ is( $page->translated_content('de')->content, 'C3', 'Found translation' ); >+ >+ # Hacking a sleep into the ORDER BY clause >+ my $hack = q|de') OR (SELECT 1 FROM (SELECT(SLEEP(10)))x)-- -|; >+ my $time1 = time; >+ is( $page->translated_content($hack)->content, 'C1', 'Hacking language param' ); >+ my $time2 = time; >+ ok( $time2 < $time1 + 10, 'The sleep has not been executed' ); >+ >+ $schema->storage->txn_rollback; >+}; >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36875
:
166804
|
166805
|
166806
|
166832
|
166833
|
166872
|
166873
|
166874
|
166875
|
166918
|
166919
|
166920
|
166921
|
167029
|
167030
|
167031
|
167032