From ed72640a4fc8c57b46557e7f978d9413f8044a3f Mon Sep 17 00:00:00 2001 From: Tomas Cohen Arazi Date: Sat, 6 Jul 2024 10:32:07 -0300 Subject: [PATCH] Bug 37018: Regression tests This patch adds regression tests. With the current codebase, the malicious query returns a 200. It should be caught and a 400 needs to be returned. To test: 1. Apply this patch 2. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/query.t => FAIL: It returns a 200 3. Once the rest of the patches are ready, repeat 2 => SUCCESS: It returns a 400 Signed-off-by: Tomas Cohen Arazi Signed-off-by: Martin Renvoize Signed-off-by: Jonathan Druart --- t/db_dependent/api/v1/query.t | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/t/db_dependent/api/v1/query.t b/t/db_dependent/api/v1/query.t index 3a9bc1bebe9..f807f21ea2b 100755 --- a/t/db_dependent/api/v1/query.t +++ b/t/db_dependent/api/v1/query.t @@ -17,7 +17,7 @@ use Modern::Perl; -use Test::More tests => 2; +use Test::More tests => 3; use Test::Mojo; use t::lib::TestBuilder; @@ -148,3 +148,30 @@ subtest 'x-koha-embed tests' => sub { $schema->storage->txn_rollback; }; + +subtest 'SQL injection in "query" handling' => sub { + + plan tests => 2; + + $schema->storage->txn_begin; + + my $librarian = $builder->build_object( + { + class => 'Koha::Patrons', + value => { flags => 1 } # superlibrarian + } + ); + my $password = 'thePassword123'; + $librarian->set_password( { password => $password, skip_validation => 1 } ); + my $userid = $librarian->userid; + + my $patron_id = $builder->build_object( { class => 'Koha::Patrons' } )->id; + + my $q = + "[{\"-and\":[[{\"me.patron_id\":{\"like(IF(ASCII(SUBSTRING((SELECT version()),1,1))=ASCII('1'),SLEEP(1/100000),0))or\":\"\%a\%\"}}]]}]"; + + $t->get_ok("//$userid:$password@/api/v1/patrons?q=$q") + ->status_is( 400, 'Attempt to inject SQL through operators is rejected' ); + + $schema->storage->txn_rollback; +}; -- 2.45.2