77import java .util .List ;
88import org .junit .jupiter .api .Test ;
99
10- /** Security tests for JsonIdentifierExpression to ensure SQL injection prevention. */
1110public class JsonIdentifierExpressionSecurityTest {
1211
13- // ===== Valid Expressions =====
14-
1512 @ Test
16- void testValidExpression_SimpleField () {
13+ void testValidExpressionSimpleField () {
1714 assertDoesNotThrow (() -> JsonIdentifierExpression .of ("props" , "brand" ));
1815 }
1916
2017 @ Test
21- void testValidExpression_NestedField () {
18+ void testValidExpressionNestedField () {
2219 assertDoesNotThrow (() -> JsonIdentifierExpression .of ("props" , "seller" , "name" ));
2320 }
2421
2522 @ Test
26- void testValidExpression_DeeplyNested () {
23+ void testValidExpressionDeeplyNested () {
2724 assertDoesNotThrow (() -> JsonIdentifierExpression .of ("props" , "seller" , "address" , "city" ));
2825 }
2926
3027 @ Test
31- void testValidExpression_WithNumbers () {
28+ void testValidExpressionWithNumbers () {
3229 assertDoesNotThrow (() -> JsonIdentifierExpression .of ("props" , "field123" ));
3330 assertDoesNotThrow (() -> JsonIdentifierExpression .of ("props" , "1st_choice" ));
3431 }
3532
3633 @ Test
37- void testValidExpression_WithUnderscore () {
34+ void testValidExpressionWithUnderscore () {
3835 assertDoesNotThrow (() -> JsonIdentifierExpression .of ("_internal" , "field" ));
3936 assertDoesNotThrow (() -> JsonIdentifierExpression .of ("props" , "_private" ));
4037 }
4138
4239 @ Test
43- void testValidExpression_UsingListConstructor () {
40+ void testValidExpressionUsingListConstructor () {
4441 assertDoesNotThrow (
4542 () -> JsonIdentifierExpression .of ("props" , List .of ("seller" , "address" , "city" )));
4643 }
4744
48- // ===== Invalid Column Names =====
49-
5045 @ Test
51- void testInvalidExpression_ColumnName_DropTable () {
46+ void testInvalidExpressionColumnNameDropTable () {
5247 SecurityException ex =
5348 assertThrows (
5449 SecurityException .class ,
@@ -57,49 +52,39 @@ void testInvalidExpression_ColumnName_DropTable() {
5752 }
5853
5954 @ Test
60- void testInvalidExpression_ColumnName_WithQuote () {
55+ void testInvalidExpressionColumnNameWithQuote () {
6156 SecurityException ex =
6257 assertThrows (
6358 SecurityException .class , () -> JsonIdentifierExpression .of ("props\" name" , "brand" ));
6459 assertTrue (ex .getMessage ().contains ("invalid" ));
6560 }
6661
6762 @ Test
68- void testInvalidExpression_ColumnName_WithSemicolon () {
63+ void testInvalidExpressionColumnNameWithSemicolon () {
6964 SecurityException ex =
7065 assertThrows (
7166 SecurityException .class , () -> JsonIdentifierExpression .of ("props;SELECT" , "brand" ));
7267 assertTrue (ex .getMessage ().contains ("invalid" ));
7368 }
7469
7570 @ Test
76- void testInvalidExpression_ColumnName_StartsWithNumber () {
71+ void testInvalidExpressionColumnNameStartsWithNumber () {
7772 SecurityException ex =
7873 assertThrows (
7974 SecurityException .class , () -> JsonIdentifierExpression .of ("123props" , "brand" ));
8075 assertTrue (ex .getMessage ().contains ("Must start with a letter or underscore" ));
8176 }
8277
8378 @ Test
84- void testInvalidExpression_ColumnName_WithHyphen () {
85- SecurityException ex =
86- assertThrows (
87- SecurityException .class , () -> JsonIdentifierExpression .of ("my-column" , "brand" ));
88- assertTrue (ex .getMessage ().contains ("invalid" ));
89- }
90-
91- @ Test
92- void testInvalidExpression_ColumnName_WithSpace () {
79+ void testInvalidExpressionColumnNameWithSpace () {
9380 SecurityException ex =
9481 assertThrows (
9582 SecurityException .class , () -> JsonIdentifierExpression .of ("my column" , "brand" ));
9683 assertTrue (ex .getMessage ().contains ("invalid" ));
9784 }
9885
99- // ===== Invalid JSON Paths =====
100-
10186 @ Test
102- void testInvalidExpression_JsonPath_WithQuote () {
87+ void testInvalidExpressionJsonPathWithQuote () {
10388 SecurityException ex =
10489 assertThrows (
10590 SecurityException .class ,
@@ -108,47 +93,47 @@ void testInvalidExpression_JsonPath_WithQuote() {
10893 }
10994
11095 @ Test
111- void testInvalidExpression_JsonPath_WithDoubleQuote () {
96+ void testInvalidExpressionJsonPathWithDoubleQuote () {
11297 SecurityException ex =
11398 assertThrows (
11499 SecurityException .class , () -> JsonIdentifierExpression .of ("props" , "name\" --" ));
115100 assertTrue (ex .getMessage ().contains ("invalid characters" ));
116101 }
117102
118103 @ Test
119- void testInvalidExpression_JsonPath_WithSemicolon () {
104+ void testInvalidExpressionJsonPathWithSemicolon () {
120105 SecurityException ex =
121106 assertThrows (
122107 SecurityException .class , () -> JsonIdentifierExpression .of ("props" , "field; DROP" ));
123108 assertTrue (ex .getMessage ().contains ("invalid characters" ));
124109 }
125110
126111 @ Test
127- void testInvalidExpression_JsonPath_WithHyphen () {
112+ void testInvalidExpressionJsonPathWithHyphen () {
128113 SecurityException ex =
129114 assertThrows (
130115 SecurityException .class , () -> JsonIdentifierExpression .of ("props" , "field-name" ));
131116 assertTrue (ex .getMessage ().contains ("invalid characters" ));
132117 }
133118
134119 @ Test
135- void testInvalidExpression_JsonPath_WithDot () {
120+ void testInvalidExpressionJsonPathWithDot () {
136121 SecurityException ex =
137122 assertThrows (
138123 SecurityException .class , () -> JsonIdentifierExpression .of ("props" , "field.name" ));
139124 assertTrue (ex .getMessage ().contains ("invalid characters" ));
140125 }
141126
142127 @ Test
143- void testInvalidExpression_JsonPath_WithSpace () {
128+ void testInvalidExpressionJsonPathWithSpace () {
144129 SecurityException ex =
145130 assertThrows (
146131 SecurityException .class , () -> JsonIdentifierExpression .of ("props" , "field name" ));
147132 assertTrue (ex .getMessage ().contains ("invalid characters" ));
148133 }
149134
150135 @ Test
151- void testInvalidExpression_JsonPath_EmptyElement () {
136+ void testInvalidExpression_sonPathEmptyElement () {
152137 SecurityException ex =
153138 assertThrows (
154139 SecurityException .class ,
@@ -157,7 +142,7 @@ void testInvalidExpression_JsonPath_EmptyElement() {
157142 }
158143
159144 @ Test
160- void testInvalidExpression_JsonPath_TooDeep () {
145+ void testInvalidExpressionJsonPathTooDeep () {
161146 String [] deepPath = new String [11 ]; // Max is 10
162147 for (int i = 0 ; i < 11 ; i ++) {
163148 deepPath [i ] = "level" + i ;
@@ -167,10 +152,8 @@ void testInvalidExpression_JsonPath_TooDeep() {
167152 assertTrue (ex .getMessage ().contains ("exceeds maximum depth" ));
168153 }
169154
170- // ===== Real-world Attack Scenarios =====
171-
172155 @ Test
173- void testAttackScenario_SqlCommentInjection () {
156+ void testAttackScenarioSqlCommentInjection () {
174157 SecurityException ex =
175158 assertThrows (
176159 SecurityException .class ,
@@ -179,7 +162,7 @@ void testAttackScenario_SqlCommentInjection() {
179162 }
180163
181164 @ Test
182- void testAttackScenario_UnionSelect () {
165+ void testAttackScenarioUnionSelect () {
183166 SecurityException ex =
184167 assertThrows (
185168 SecurityException .class ,
@@ -190,7 +173,7 @@ void testAttackScenario_UnionSelect() {
190173 }
191174
192175 @ Test
193- void testAttackScenario_OrTrueInjection () {
176+ void testAttackScenarioOrTrueInjection () {
194177 SecurityException ex =
195178 assertThrows (
196179 SecurityException .class ,
@@ -199,7 +182,7 @@ void testAttackScenario_OrTrueInjection() {
199182 }
200183
201184 @ Test
202- void testAttackScenario_NestedInjection () {
185+ void testAttackScenarioNestedInjection () {
203186 SecurityException ex =
204187 assertThrows (
205188 SecurityException .class ,
@@ -208,7 +191,7 @@ void testAttackScenario_NestedInjection() {
208191 }
209192
210193 @ Test
211- void testAttackScenario_SpecialCharacterCombination () {
194+ void testAttackScenarioSpecialCharacterCombination () {
212195 SecurityException ex =
213196 assertThrows (
214197 SecurityException .class , () -> JsonIdentifierExpression .of ("props" , "field'\" `;DROP" ));
0 commit comments