require 'spec_helper'
require 'ronin/exploits/sqli'

describe Ronin::Exploits::SQLI do
  module TestSQLI
    class TestExploit < Ronin::Exploits::SQLI
      base_path   '/showthread.asp'
      query_param 'id'
    end
  end

  let(:exploit_class) { TestSQLI::TestExploit }
  let(:base_url)      { 'http://testasp.vulnweb.com' }

  subject do
    exploit_class.new(
      params: {
        base_url: base_url
      }
    )
  end

  describe ".exploit_type" do
    subject { described_class }

    it { expect(subject.exploit_type).to eq(:sqli) }
  end

  describe ".escape_quote" do
    subject { exploit_class }

    context "and when escape_quote is not set in the class" do
      module TestSQLI
        class WithNoEscapeQuoteSet < Ronin::Exploits::SQLI
        end
      end

      let(:exploit_class) { TestSQLI::WithNoEscapeQuoteSet }

      it "must default to false" do
        expect(subject.escape_quote).to be(false)
      end
    end

    context "and when escape_quote is set in the class" do
      module TestSQLI
        class WithEscapeQuoteSet < Ronin::Exploits::SQLI
          escape_quote true
        end
      end

      let(:exploit_class) { TestSQLI::WithEscapeQuoteSet }

      it "must return the set escape_quote" do
        expect(subject.escape_quote).to eq(true)
      end
    end

    context "but when the escape_quote was set in the superclass" do
      module TestSQLI
        class InheritsItsEscapeQuote < WithEscapeQuoteSet
        end
      end

      let(:exploit_class) { TestSQLI::InheritsItsEscapeQuote }

      it "must return the escape_quote set in the superclass" do
        expect(subject.escape_quote).to eq(true)
      end

      context "but the escape_quote is overridden in the sub-class" do
        module TestSQLI
          class OverridesItsInheritedEscapeQuote < WithEscapeQuoteSet
            escape_quote false
          end
        end

        let(:exploit_class) do
          TestSQLI::OverridesItsInheritedEscapeQuote
        end

        it "must return the escape_quote set in the sub-class" do
          expect(subject.escape_quote).to eq(false)
        end
      end
    end
  end

  describe ".escape_parens" do
    subject { exploit_class }

    context "and when escape_parens is not set in the class" do
      module TestSQLI
        class WithNoEscapeParensSet < Ronin::Exploits::SQLI
        end
      end

      let(:exploit_class) { TestSQLI::WithNoEscapeParensSet }

      it "must default to false" do
        expect(subject.escape_parens).to be(false)
      end
    end

    context "and when escape_parens is set in the class" do
      module TestSQLI
        class WithEscapeParensSet < Ronin::Exploits::SQLI
          escape_parens true
        end
      end

      let(:exploit_class) { TestSQLI::WithEscapeParensSet }

      it "must return the set escape_parens" do
        expect(subject.escape_parens).to eq(true)
      end
    end

    context "but when the escape_parens was set in the superclass" do
      module TestSQLI
        class InheritsItsEscapeParens < WithEscapeParensSet
        end
      end

      let(:exploit_class) { TestSQLI::InheritsItsEscapeParens }

      it "must return the escape_parens set in the superclass" do
        expect(subject.escape_parens).to eq(true)
      end

      context "but the escape_parens is overridden in the sub-class" do
        module TestSQLI
          class OverridesItsInheritedEscapeParens < WithEscapeParensSet
            escape_parens false
          end
        end

        let(:exploit_class) do
          TestSQLI::OverridesItsInheritedEscapeParens
        end

        it "must return the escape_parens set in the sub-class" do
          expect(subject.escape_parens).to eq(false)
        end
      end
    end
  end

  describe ".terminate" do
    subject { exploit_class }

    context "and when terminate is not set in the class" do
      module TestSQLI
        class WithNoTerminateSet < Ronin::Exploits::SQLI
        end
      end

      let(:exploit_class) { TestSQLI::WithNoTerminateSet }

      it "must default to false" do
        expect(subject.terminate).to be(false)
      end
    end

    context "and when terminate is set in the class" do
      module TestSQLI
        class WithTerminateSet < Ronin::Exploits::SQLI
          terminate true
        end
      end

      let(:exploit_class) { TestSQLI::WithTerminateSet }

      it "must return the set terminate" do
        expect(subject.terminate).to eq(true)
      end
    end

    context "but when the terminate was set in the superclass" do
      module TestSQLI
        class InheritsItsTerminate < WithTerminateSet
        end
      end

      let(:exploit_class) { TestSQLI::InheritsItsTerminate }

      it "must return the terminate set in the superclass" do
        expect(subject.terminate).to eq(true)
      end

      context "but the terminate is overridden in the sub-class" do
        module TestSQLI
          class OverridesItsInheritedTerminate < WithTerminateSet
            terminate false
          end
        end

        let(:exploit_class) do
          TestSQLI::OverridesItsInheritedTerminate
        end

        it "must return the terminate set in the sub-class" do
          expect(subject.terminate).to eq(false)
        end
      end
    end
  end

  describe "#vuln" do
    it "must return a Ronin::Vulns::SQLI object" do
      expect(subject.vuln).to be_kind_of(Ronin::Vulns::SQLI)
    end

    it "must set the #url attribute of the SQLI vuln object" do
      expect(subject.vuln.url).to eq(subject.url)
    end

    it "must default the #escape_quote attribute of the SQLI vuln object to false" do
      expect(subject.vuln.escape_quote).to be(false)
    end

    context "when the exploit class sets escape_quote" do
      module TestSQLI
        class TestExploitWithEscapeQuote < Ronin::Exploits::SQLI
          base_path    '/showthread.asp'
          query_param  'id'
          escape_quote true
        end
      end

      let(:exploit_class) { TestSQLI::TestExploitWithEscapeQuote }

      it "must set the #escape_quote attribute of the SQLI vuln object to the exploit class'es escape_quote" do
        expect(subject.vuln.escape_quote).to eq(exploit_class.escape_quote)
      end
    end

    it "must default the #escape_parens attribute of the SQLI vuln object to false" do
      expect(subject.vuln.escape_parens).to be(false)
    end

    context "when the exploit class sets escape_parens" do
      module TestSQLI
        class TestExploitWithEscapeParens < Ronin::Exploits::SQLI
          base_path    '/showthread.asp'
          query_param  'id'
          escape_parens true
        end
      end

      let(:exploit_class) { TestSQLI::TestExploitWithEscapeParens }

      it "must set the #escape_parens attribute of the SQLI vuln object to the exploit class'es escape_parens" do
        expect(subject.vuln.escape_parens).to eq(exploit_class.escape_parens)
      end
    end

    it "must default the #terminate attribute of the SQLI vuln object to false" do
      expect(subject.vuln.terminate).to be(false)
    end

    context "when the exploit class sets terminate" do
      module TestSQLI
        class TestExploitWithTerminate < Ronin::Exploits::SQLI
          base_path    '/showthread.asp'
          query_param  'id'
          terminate    true
        end
      end

      let(:exploit_class) { TestSQLI::TestExploitWithTerminate }

      it "must set the #terminate attribute of the SQLI vuln object to the exploit class'es terminate" do
        expect(subject.vuln.terminate).to eq(exploit_class.terminate)
      end
    end
  end

  describe "#launch" do
    module TestSQLI
      class SQLPayload < Ronin::Payloads::SQLPayload
        def build
          @payload = 'SQL PAYLOAD HERE();'
        end
      end
    end

    let(:payload_class) { TestSQLI::SQLPayload }
    let(:payload)       { payload_class.new   }

    subject do
      exploit_class.new(
        payload: payload,
        params: {
          base_url: base_url
        }
      )
    end

    it "must call #exploit on the #vuln object with the #payload" do
      expect(subject.vuln).to receive(:exploit).with(payload)

      subject.launch
    end
  end
end