From 0bcccd3b067933d59e889d97732ce302d147b1b7 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Mon, 6 Jan 2025 14:26:00 +0100 Subject: [PATCH] Bug 38829: Add a test Signed-off-by: Magnus Enger --- t/db_dependent/Serials/Claims.t | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/t/db_dependent/Serials/Claims.t b/t/db_dependent/Serials/Claims.t index afc3a18e66..34c4fba1ff 100755 --- a/t/db_dependent/Serials/Claims.t +++ b/t/db_dependent/Serials/Claims.t @@ -1,5 +1,5 @@ use Modern::Perl; -use Test::More tests => 17; +use Test::More tests => 18; use C4::Acquisition; use C4::Budgets qw( AddBudgetPeriod AddBudget ); @@ -162,3 +162,12 @@ is( $serial_claimed->{claims_count}, 1, 'The serial should have been claimed' ); my $today = output_pref({ dt => dt_from_string, dateformat => 'iso', dateonly => 1 }); # FIXME: This test should pass. The GetLateOrMissingIssues should not deal with date format! #is( $serial_claimed->{claimdate}, $today, 'The serial should have been claimed today' ); + +subtest 'prevent SQL injections' => sub { + plan tests => 1; + my $time1 = time; + my $hack = q|1 OR (SELECT 1 FROM (SELECT(SLEEP(10)))x)-- -|; + GetLateOrMissingIssues($hack); + my $time2 = time; + ok( $time2 < $time1 + 10, 'The sleep should not be executed' ); +}; -- 2.34.1