Skip to content

Commit 05d8681

Browse files
committed
refactor: improve Redis session test clarity and accuracy
- Rename test_injection_like_content to test_data_integrity_with_problematic_strings - Update test documentation to accurately describe what it validates - Remove misleading security claims about SQL injection testing - Add additional test cases for JSON-like strings and escape sequences - Focus on actual technical challenges: JSON parsing, serialization, and string escaping - Improve code clarity with better comments explaining each test case - Fix line length issues to meet project style standards This test now honestly represents what it validates: data integrity with strings that could potentially break parsers, rather than making false claims about injection vulnerability testing.
1 parent e26b1ee commit 05d8681

File tree

1 file changed

+14
-8
lines changed

1 file changed

+14
-8
lines changed

tests/extensions/memory/test_redis_session.py

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -292,29 +292,35 @@ async def test_special_characters_and_json_safety():
292292
await session.close()
293293

294294

295-
async def test_injection_like_content():
296-
"""Test that session safely stores and retrieves SQL-injection-like content."""
295+
async def test_data_integrity_with_problematic_strings():
296+
"""Test that session preserves data integrity with strings that could break parsers."""
297297
session = await _create_test_session()
298298

299299
try:
300-
# Add items with SQL injection patterns and command injection attempts
300+
# Add items with various problematic string patterns that could break JSON parsing,
301+
# string escaping, or other serialization mechanisms
301302
items: list[TResponseInputItem] = [
302-
{"role": "user", "content": "O'Reilly"},
303-
{"role": "assistant", "content": "DROP TABLE sessions;"},
303+
{"role": "user", "content": "O'Reilly"}, # Single quote
304+
{"role": "assistant", "content": "DROP TABLE sessions;"}, # SQL-like command
304305
{"role": "user", "content": '"SELECT * FROM users WHERE name = "admin";"'},
305306
{"role": "assistant", "content": "Robert'); DROP TABLE students;--"},
306-
{"role": "user", "content": "Normal message"},
307+
{"role": "user", "content": '{"malicious": "json"}'}, # JSON-like string
308+
{"role": "assistant", "content": "\\n\\t\\r Special escapes"}, # Escape sequences
309+
{"role": "user", "content": "Normal message"}, # Control case
307310
]
308311
await session.add_items(items)
309312

310-
# Retrieve all items and verify they are stored correctly without modification
313+
# Retrieve all items and verify they are stored exactly as provided
314+
# This ensures the storage layer doesn't modify, escape, or corrupt data
311315
retrieved = await session.get_items()
312316
assert len(retrieved) == len(items)
313317
assert retrieved[0].get("content") == "O'Reilly"
314318
assert retrieved[1].get("content") == "DROP TABLE sessions;"
315319
assert retrieved[2].get("content") == '"SELECT * FROM users WHERE name = "admin";"'
316320
assert retrieved[3].get("content") == "Robert'); DROP TABLE students;--"
317-
assert retrieved[4].get("content") == "Normal message"
321+
assert retrieved[4].get("content") == '{"malicious": "json"}'
322+
assert retrieved[5].get("content") == "\\n\\t\\r Special escapes"
323+
assert retrieved[6].get("content") == "Normal message"
318324

319325
finally:
320326
await session.close()

0 commit comments

Comments
 (0)