Attachment 169832 Details for Bug 37018 – Bug 37018: Regression tests

[patch] Bug 37018: Regression tests

Bug-37018-Regression-tests.patch (text/plain), 2.13 KB, created by Tomás Cohen Arazi (tcohen) on 2024-07-29 12:49:06 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomás Cohen Arazi (tcohen)

Created: 2024-07-29 12:49:06 UTC

Size: 2.13 KB

patch

obsolete

>From ed72640a4fc8c57b46557e7f978d9413f8044a3f Mon Sep 17 00:00:00 2001
>From: Tomas Cohen Arazi <tomascohen@theke.io>
>Date: Sat, 6 Jul 2024 10:32:07 -0300
>Subject: [PATCH] Bug 37018: Regression tests
>
>This patch adds regression tests. With the current codebase, the
>malicious query returns a 200. It should be caught and a 400 needs to be
>returned.
>
>To test:
>1. Apply this patch
>2. Run:
>   $ ktd --shell
>  k$ prove t/db_dependent/api/v1/query.t
>=> FAIL: It returns a 200
>3. Once the rest of the patches are ready, repeat 2
>=> SUCCESS: It returns a 400
>
>Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
>Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>
>Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>---
> t/db_dependent/api/v1/query.t | 29 ++++++++++++++++++++++++++++-
> 1 file changed, 28 insertions(+), 1 deletion(-)
>
>diff --git a/t/db_dependent/api/v1/query.t b/t/db_dependent/api/v1/query.t
>index 3a9bc1bebe9..f807f21ea2b 100755
>--- a/t/db_dependent/api/v1/query.t
>+++ b/t/db_dependent/api/v1/query.t
>@@ -17,7 +17,7 @@
> 
> use Modern::Perl;
> 
>-use Test::More tests => 2;
>+use Test::More tests => 3;
> use Test::Mojo;
> 
> use t::lib::TestBuilder;
>@@ -148,3 +148,30 @@ subtest 'x-koha-embed tests' => sub {
> 
>     $schema->storage->txn_rollback;
> };
>+
>+subtest 'SQL injection in "query" handling' => sub {
>+
>+    plan tests => 2;
>+
>+    $schema->storage->txn_begin;
>+
>+    my $librarian = $builder->build_object(
>+        {
>+            class => 'Koha::Patrons',
>+            value => { flags => 1 }     # superlibrarian
>+        }
>+    );
>+    my $password = 'thePassword123';
>+    $librarian->set_password( { password => $password, skip_validation => 1 } );
>+    my $userid = $librarian->userid;
>+
>+    my $patron_id = $builder->build_object( { class => 'Koha::Patrons' } )->id;
>+
>+    my $q =
>+        "[{\"-and\":[[{\"me.patron_id\":{\"like(IF(ASCII(SUBSTRING((SELECT version()),1,1))=ASCII('1'),SLEEP(1/100000),0))or\":\"\%a\%\"}}]]}]";
>+
>+    $t->get_ok("//$userid:$password@/api/v1/patrons?q=$q")
>+        ->status_is( 400, 'Attempt to inject SQL through operators is rejected' );
>+
>+    $schema->storage->txn_rollback;
>+};
>-- 
>2.45.2

Actions: View | Diff | Splinter Review

Attachments on bug 37018: 167440 | 167441 | 167442 | 167446 | 167447 | 167448 | 167449 | 167603 | 167672 | 167691 | 167772 | 168458 | 168582 | 168583 | 168584 | 168585 | 168586 | 168587 | 168616 | 168617 | 168618 | 168619 | 168620 | 168621 | 168622 | 168624 | 168626 | 168627 | 168628 | 168629 | 168630 | 168631 | 168632 | 168633 | 168634 | 168635 | 168654 | 168655 | 168656 | 168657 | 168658 | 168659 | 168660 | 168661 | 168662 | 168695 | 168696 | 168697 | 168698 | 168699 | 168700 | 168701 | 168702 | 168703 | 168704 | 168786 | 168787 | 168788 | 168789 | 168790 | 168791 | 168792 | 168793 | 168794 | 168795 | 169309 | 169337 | 169338 | 169339 | 169340 | 169341 | 169342 | 169343 | 169344 | 169345 | 169346 | 169368 | 169369 | 169370 | 169371 | 169372 | 169373 | 169374 | 169375 | 169376 | 169377 | 169378 | 169414 | 169832 | 169833 | 169834 | 169835 | 169836 | 169837 | 169838 | 169839 | 169840 | 169841