diff options
| author | David Heinemeier Hansson <david@loudthinking.com> | 2008-05-31 16:57:46 -0700 |
|---|---|---|
| committer | David Heinemeier Hansson <david@loudthinking.com> | 2008-05-31 16:57:46 -0700 |
| commit | ef0ea782b1f5cf7b08e74ea3002a16c708f66645 (patch) | |
| tree | e5bafb8aacf682d2df36d598a14ae1f623c5a258 /activerecord/test | |
| parent | a6e79083273dfb1a62aa8ff02db07454c65729ff (diff) | |
| download | rails-ef0ea782b1f5cf7b08e74ea3002a16c708f66645.tar.gz rails-ef0ea782b1f5cf7b08e74ea3002a16c708f66645.tar.bz2 rails-ef0ea782b1f5cf7b08e74ea3002a16c708f66645.zip | |
Added SQL escaping for :limit and :offset [#288 state:closed] (Aaron Bedra, Steven Bristol, Jonathan Wiess)
Diffstat (limited to 'activerecord/test')
| -rw-r--r-- | activerecord/test/cases/adapter_test.rb | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/activerecord/test/cases/adapter_test.rb b/activerecord/test/cases/adapter_test.rb index 91504af901..c77446f880 100644 --- a/activerecord/test/cases/adapter_test.rb +++ b/activerecord/test/cases/adapter_test.rb @@ -104,4 +104,24 @@ class AdapterTest < ActiveRecord::TestCase end end + def test_add_limit_offset_should_sanitize_sql_injection_for_limit_without_comas + sql_inject = "1 select * from schema" + assert_equal " LIMIT 1", @connection.add_limit_offset!("", :limit=>sql_inject) + if current_adapter?(:MysqlAdapter) + assert_equal " LIMIT 7, 1", @connection.add_limit_offset!("", :limit=>sql_inject, :offset=>7) + else + assert_equal " LIMIT 1 OFFSET 7", @connection.add_limit_offset!("", :limit=>sql_inject, :offset=>7) + end + end + + def test_add_limit_offset_should_sanitize_sql_injection_for_limit_with_comas + sql_inject = "1, 7 procedure help()" + if current_adapter?(:MysqlAdapter) + assert_equal " LIMIT 1,7", @connection.add_limit_offset!("", :limit=>sql_inject) + assert_equal " LIMIT 7, 1", @connection.add_limit_offset!("", :limit=>sql_inject, :offset=>7) + else + assert_equal " LIMIT 1,7", @connection.add_limit_offset!("", :limit=>sql_inject) + assert_equal " LIMIT 1,7 OFFSET 7", @connection.add_limit_offset!("", :limit=>sql_inject, :offset=>7) + end + end end |