Skip to content

Commit d6bbeab

Browse files
committed
Move test to MySQL test cases
`#` style comments are not supported in postgres and sqlite
1 parent 981cfff commit d6bbeab

File tree

1 file changed

+10
-8
lines changed

1 file changed

+10
-8
lines changed

test/aikido/zen/scanners/sql_injection_scanner_test.rb

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -126,14 +126,6 @@ def refute_attack(query, input = query, *args)
126126
b
127127
c
128128
INPUT
129-
130-
assert_attack <<~QUERY.chomp, <<~INPUT.chomp
131-
SELECT * FROM users WHERE id = 'a'
132-
OR 1=1#'
133-
QUERY
134-
a'
135-
OR 1=1#
136-
INPUT
137129
end
138130

139131
test "handles multiline queries" do
@@ -339,6 +331,16 @@ def refute_attack(query, input = query, *args)
339331
refute_attack "SELECT * FROM users WHERE id = 'SET CHARSET utf8'", "SET CHARSET utf8"
340332
refute_attack "SELECT * FROM users WHERE id = 'SET CHARSET=utf8'", "SET CHARSET=utf8"
341333
end
334+
335+
test "handles multiline inputs" do
336+
assert_attack <<~QUERY.chomp, <<~INPUT.chomp
337+
SELECT * FROM users WHERE id = 'a'
338+
OR 1=1#'
339+
QUERY
340+
a'
341+
OR 1=1#
342+
INPUT
343+
end
342344
end
343345

344346
class TestPostgreSQLDialect < ActiveSupport::TestCase

0 commit comments

Comments
 (0)