Contents

require File.dirname(__FILE__) + '/test_helper.rb'

class TestSearchProtection < Test::Unit::TestCase
  def test_protection
    assert_raise(ArgumentError) { Account.build_search(:conditions => "(DELETE FROM users)", :page => 2, :per_page => 15) }
    Searchgasm::Search::Base::VULNERABLE_FIND_OPTIONS.each { |option| assert_raise(ArgumentError) { Account.build_search(option => "(DELETE FROM users)") } }
  
    assert_nothing_raised { Account.build_search!(:conditions => "(DELETE FROM users)", :page => 2, :per_page => 15) }
    Searchgasm::Search::Base::VULNERABLE_FIND_OPTIONS.each { |option| assert_nothing_raised { Account.build_search!(option => "(DELETE FROM users)") } }
  
    account = Account.first
  
    assert_raise(ArgumentError) { account.users.build_search(:conditions => "(DELETE FROM users)", :page => 2, :per_page => 15) }
    Searchgasm::Search::Base::VULNERABLE_FIND_OPTIONS.each { |option| assert_raise(ArgumentError) { account.users.build_search(option => "(DELETE FROM users)") } }
  
    assert_nothing_raised { account.users.build_search!(:conditions => "(DELETE FROM users)", :page => 2, :per_page => 15) }
    Searchgasm::Search::Base::VULNERABLE_FIND_OPTIONS.each { |option| assert_nothing_raised { account.users.build_search!(option => "(DELETE FROM users)") } }
  
    assert_raise(ArgumentError) { Account.build_search(:order_by => "unknown_column") }
    assert_nothing_raised { Account.build_search!(:order_by => "unknown_column") }
    assert_raise(ArgumentError) { Account.build_search(:order_by => ["name", "unknown_column"]) }
    assert_nothing_raised { Account.build_search!(:order_by => ["name", "unknown_column"]) }
  end
end

Version data entries

15 entries across 15 versions & 1 rubygems

Version	Path
searchgasm-1.3.2	test/test_search_protection.rb
searchgasm-1.2.2	test/test_search_protection.rb
searchgasm-1.3.1	test/test_search_protection.rb
searchgasm-1.2.1	test/test_search_protection.rb
searchgasm-1.3.0	test/test_search_protection.rb
searchgasm-1.2.0	test/test_search_protection.rb
searchgasm-1.3.4	test/test_search_protection.rb
searchgasm-1.3.3	test/test_search_protection.rb
searchgasm-1.5.0	test/test_search_protection.rb
searchgasm-1.5.2	test/test_search_protection.rb
searchgasm-1.5.3	test/test_search_protection.rb
searchgasm-1.4.0	test/test_search_protection.rb
searchgasm-1.4.1	test/test_search_protection.rb
searchgasm-1.3.5	test/test_search_protection.rb
searchgasm-1.5.1	test/test_search_protection.rb