diff options
| author | Michael Koziarski <michael@koziarski.com> | 2008-06-04 11:05:46 +1200 |
|---|---|---|
| committer | Michael Koziarski <michael@koziarski.com> | 2008-06-04 11:05:46 +1200 |
| commit | e3c26e9926948587efcc8d31c729395093407df6 (patch) | |
| tree | 358f418791a56620c32a48776739b4fdf39d3cb0 /activerecord/test/cases/adapter_test.rb | |
| parent | b9a9b91a3e3b892ab72ff5c618181747d6b4be04 (diff) | |
| parent | 8afa725f4b98a6e0ceee4792e8ebaebb6189e5f6 (diff) | |
| download | rails-e3c26e9926948587efcc8d31c729395093407df6.tar.gz rails-e3c26e9926948587efcc8d31c729395093407df6.tar.bz2 rails-e3c26e9926948587efcc8d31c729395093407df6.zip | |
Merge branch 'master' into patches
Diffstat (limited to 'activerecord/test/cases/adapter_test.rb')
| -rw-r--r-- | activerecord/test/cases/adapter_test.rb | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/activerecord/test/cases/adapter_test.rb b/activerecord/test/cases/adapter_test.rb index 91504af901..11f9870534 100644 --- a/activerecord/test/cases/adapter_test.rb +++ b/activerecord/test/cases/adapter_test.rb @@ -104,4 +104,24 @@ class AdapterTest < ActiveRecord::TestCase end end + def test_add_limit_offset_should_sanitize_sql_injection_for_limit_without_comas + sql_inject = "1 select * from schema" + assert_equal " LIMIT 1", @connection.add_limit_offset!("", :limit=>sql_inject) + if current_adapter?(:MysqlAdapter) + assert_equal " LIMIT 7, 1", @connection.add_limit_offset!("", :limit=>sql_inject, :offset=>7) + else + assert_equal " LIMIT 1 OFFSET 7", @connection.add_limit_offset!("", :limit=>sql_inject, :offset=>7) + end + end + + def test_add_limit_offset_should_sanitize_sql_injection_for_limit_with_comas + sql_inject = "1, 7 procedure help()" + if current_adapter?(:MysqlAdapter) + assert_equal " LIMIT 1,7", @connection.add_limit_offset!("", :limit=>sql_inject) + assert_equal " LIMIT 7, 1", @connection.add_limit_offset!("", :limit=> '1 ; DROP TABLE USERS', :offset=>7) + else + assert_equal " LIMIT 1,7", @connection.add_limit_offset!("", :limit=>sql_inject) + assert_equal " LIMIT 1,7 OFFSET 7", @connection.add_limit_offset!("", :limit=>sql_inject, :offset=>7) + end + end end |