22 lines
631 B
Python
22 lines
631 B
Python
from app.native.wndb import s2_junctions
|
|
|
|
|
|
def test_get_junction_binds_untrusted_identifier(monkeypatch) -> None:
|
|
calls: list[tuple[str, str, tuple[str, ...]]] = []
|
|
malicious_id = "J-1'; DELETE FROM junctions; --"
|
|
|
|
def fake_try_read(name, statement, params):
|
|
calls.append((name, statement, params))
|
|
return None
|
|
|
|
monkeypatch.setattr(s2_junctions, "try_read", fake_try_read)
|
|
|
|
assert s2_junctions.get_junction("project_a", malicious_id) == {}
|
|
assert calls == [
|
|
(
|
|
"project_a",
|
|
"select * from junctions where id = %s",
|
|
(malicious_id,),
|
|
)
|
|
]
|