From 81a230ccdc435e460a4f1f823d9c3cbbc5f099c9 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Mon, 6 Jan 2025 14:26:00 +0100 Subject: [PATCH] Bug 38829: Add a test Content-Type: text/plain; charset=utf-8 Signed-off-by: Magnus Enger Signed-off-by: Marcel de Rooy [EDIT] Added a shebang line. --- t/db_dependent/Serials/Claims.t | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/t/db_dependent/Serials/Claims.t b/t/db_dependent/Serials/Claims.t index afc3a18e66..d121dc8ffb 100755 --- a/t/db_dependent/Serials/Claims.t +++ b/t/db_dependent/Serials/Claims.t @@ -1,5 +1,7 @@ +#!/usr/bin/perl + use Modern::Perl; -use Test::More tests => 17; +use Test::More tests => 18; use C4::Acquisition; use C4::Budgets qw( AddBudgetPeriod AddBudget ); @@ -162,3 +164,12 @@ is( $serial_claimed->{claims_count}, 1, 'The serial should have been claimed' ); my $today = output_pref({ dt => dt_from_string, dateformat => 'iso', dateonly => 1 }); # FIXME: This test should pass. The GetLateOrMissingIssues should not deal with date format! #is( $serial_claimed->{claimdate}, $today, 'The serial should have been claimed today' ); + +subtest 'prevent SQL injections' => sub { + plan tests => 1; + my $time1 = time; + my $hack = q|1 OR (SELECT 1 FROM (SELECT(SLEEP(10)))x)-- -|; + GetLateOrMissingIssues($hack); + my $time2 = time; + ok( $time2 < $time1 + 10, 'The sleep should not be executed' ); +}; -- 2.39.5