From 98058a4b8811fd5a69521b77249204190137b958 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Mon, 6 Jan 2025 14:26:00 +0100
Subject: [PATCH] Bug 38829: Add a test

---
 t/db_dependent/Serials/Claims.t | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/t/db_dependent/Serials/Claims.t b/t/db_dependent/Serials/Claims.t
index afc3a18e663..34c4fba1ff8 100755
--- a/t/db_dependent/Serials/Claims.t
+++ b/t/db_dependent/Serials/Claims.t
@@ -1,5 +1,5 @@
 use Modern::Perl;
-use Test::More tests => 17;
+use Test::More tests => 18;
 
 use C4::Acquisition;
 use C4::Budgets qw( AddBudgetPeriod AddBudget );
@@ -162,3 +162,12 @@ is( $serial_claimed->{claims_count}, 1, 'The serial should have been claimed' );
 my $today = output_pref({ dt => dt_from_string, dateformat => 'iso', dateonly => 1 });
 # FIXME: This test should pass. The GetLateOrMissingIssues should not deal with date format!
 #is( $serial_claimed->{claimdate}, $today, 'The serial should have been claimed today' );
+
+subtest 'prevent SQL injections' => sub {
+    plan tests => 1;
+    my $time1 = time;
+    my $hack  = q|1 OR (SELECT 1 FROM (SELECT(SLEEP(10)))x)-- -|;
+    GetLateOrMissingIssues($hack);
+    my $time2 = time;
+    ok( $time2 < $time1 + 10, 'The sleep should not be executed' );
+};
-- 
2.34.1