diff options
| author | Emilio Tagua <miloops@gmail.com> | 2010-03-25 12:27:34 -0300 |
|---|---|---|
| committer | Emilio Tagua <miloops@gmail.com> | 2010-03-25 12:37:38 -0300 |
| commit | e3a2fae05dfce39bbac86780c28b102acc3aa68f (patch) | |
| tree | 49fb16b235edf44e74940ab0d93617ee6e9a9013 /activerecord/test | |
| parent | ed21f0c50270139ddb6993acfdaea4586ffd09a3 (diff) | |
| download | rails-e3a2fae05dfce39bbac86780c28b102acc3aa68f.tar.gz rails-e3a2fae05dfce39bbac86780c28b102acc3aa68f.tar.bz2 rails-e3a2fae05dfce39bbac86780c28b102acc3aa68f.zip | |
Add add_limit_offset! to adapters.
Diffstat (limited to 'activerecord/test')
| -rw-r--r-- | activerecord/test/cases/adapter_test.rb | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/activerecord/test/cases/adapter_test.rb b/activerecord/test/cases/adapter_test.rb index c59be264a4..9b28766405 100644 --- a/activerecord/test/cases/adapter_test.rb +++ b/activerecord/test/cases/adapter_test.rb @@ -142,4 +142,25 @@ class AdapterTest < ActiveRecord::TestCase end end end + + def test_add_limit_offset_should_sanitize_sql_injection_for_limit_without_comas + sql_inject = "1 select * from schema" + assert_equal " LIMIT 1", @connection.add_limit_offset!("", :limit => sql_inject) + if current_adapter?(:MysqlAdapter) + assert_equal " LIMIT 7, 1", @connection.add_limit_offset!("", :limit => sql_inject, :offset => 7) + else + assert_equal " LIMIT 1 OFFSET 7", @connection.add_limit_offset!("", :limit => sql_inject, :offset => 7) + end + end + + def test_add_limit_offset_should_sanitize_sql_injection_for_limit_with_comas + sql_inject = "1, 7 procedure help()" + if current_adapter?(:MysqlAdapter) + assert_equal " LIMIT 1,7", @connection.add_limit_offset!("", :limit => sql_inject) + assert_equal " LIMIT 7, 1", @connection.add_limit_offset!("", :limit => '1 ; DROP TABLE USERS', :offset => 7) + else + assert_equal " LIMIT 1,7", @connection.add_limit_offset!("", :limit => sql_inject) + assert_equal " LIMIT 1,7 OFFSET 7", @connection.add_limit_offset!("", :limit => sql_inject, :offset => 7) + end + end end |