From aa4f981da94d1028c5d71022fad46d6e11cc7aa7 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Wed, 15 May 2024 11:25:47 +0200 Subject: [PATCH] Bug 36520: Add tests --- t/db_dependent/Letters.t | 40 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 39 insertions(+), 1 deletion(-) diff --git a/t/db_dependent/Letters.t b/t/db_dependent/Letters.t index 8ae4bcd3e24..ccbb00cac20 100755 --- a/t/db_dependent/Letters.t +++ b/t/db_dependent/Letters.t @@ -18,7 +18,7 @@ # along with Koha; if not, see . use Modern::Perl; -use Test::More tests => 100; +use Test::More tests => 101; use Test::MockModule; use Test::Warn; use Test::Exception; @@ -1523,3 +1523,41 @@ subtest 'Template toolkit syntax in parameters' => sub { 'Template toolkit syntax in parameter was not evaluated.' ); }; + +subtest 'Quote user params in GetPreparedLetter' => sub { + plan tests => 1; + + my $patron = $builder->build_object( { class => 'Koha::Patrons' } ); + my $biblio = $builder->build_sample_biblio; + my %loops = ( biblio => [ $biblio->biblionumber . ') AND (SELECT 1 FROM (SELECT(SLEEP(10)))x)-- -' ] ); + my %substitute = ( comment => 'some comment' ); + + Koha::Notice::Template->new( + { + module => 'catalogue', + code => 'CART', + branchcode => '', + message_transport_type => 'email', + content => + 'Hello [% borrower.firstname %], Some comments about those biblios [% FOR b IN biblios %][% biblio.title %][% END %]: [% comment %]', + } + )->store; + + my $t = time; + my $letter = C4::Letters::GetPreparedLetter( + module => 'catalogue', + letter_code => 'CART', + tables => { + borrowers => $patron->borrowernumber, + }, + message_transport_type => 'email', + loops => \%loops, + substitute => \%substitute, + ); + my $exec_time = time - $t; + ok( $exec_time < 10, "We should not exec the SLEEP" ) + or diag sprintf( + "Spent %ss to run GetPreparredLetter, SLEEP has certainly been executed which could lead to SQL injections", + $exec_time + ); +}; -- 2.34.1