(a *assert.Assertion, t *testing.T, template *waf.WAF)
| 295 | } |
| 296 | |
| 297 | func testTemplate7010(a *assert.Assertion, t *testing.T, template *waf.WAF) { |
| 298 | for _, id := range []string{ |
| 299 | " union all select id from credits", |
| 300 | "' or 1=1", |
| 301 | "' or '1'='1", |
| 302 | "1' or '1'='1')) /*", |
| 303 | "OR 1/** this is comment **/=1", |
| 304 | "AND 1=2", |
| 305 | "; INSERT INTO users (...)", |
| 306 | "order by 10--", |
| 307 | "UNION SELECT 1,null,null--", |
| 308 | "' AND ASCII(SUBSTRING(username, 1, 1))=97 AND '1'='1", |
| 309 | "||UTL_INADDR.GET_HOST_NAME((SELECT user FROM dual) )--", |
| 310 | " AND IF(version() like '5%', sleep(10), 'false')", |
| 311 | "; update tablename set code='javascript code' where 1--", |
| 312 | "AND @@version like '5.0%', ", |
| 313 | "/*!40110 and 1=0*/", |
| 314 | "AND 1=0 UNION SELECT DATABASE()", |
| 315 | "load_file('filename')", |
| 316 | "limit 1 into outfile 'aaa'", |
| 317 | "OR IF(1, BENCHMARK(#ofcicies, action_to_be_performed), 'false')", |
| 318 | "AND 1=CONVERT(int, db_name())", |
| 319 | |
| 320 | // PostgresSQL |
| 321 | "and 1::int=1", |
| 322 | } { |
| 323 | req, err := http.NewRequest(http.MethodPost, "https://example.com/?id=1 "+url.QueryEscape(id), nil) |
| 324 | if err != nil { |
| 325 | t.Fatal(err) |
| 326 | } |
| 327 | req.Header.Set("User-Agent", testUserAgent) |
| 328 | result, err := template.MatchRequest(requests.NewTestRequest(req), nil, firewallconfigs.ServerCaptchaTypeNone) |
| 329 | if err != nil { |
| 330 | t.Fatal(err) |
| 331 | } |
| 332 | a.IsNotNil(result.Set) |
| 333 | if result.Set != nil { |
| 334 | a.IsTrue(lists.ContainsAny([]string{"7010"}, result.Set.Code)) |
| 335 | } else { |
| 336 | t.Log("break:", id) |
| 337 | } |
| 338 | } |
| 339 | } |
| 340 | |
| 341 | func TestTemplateSQLInjection(t *testing.T) { |
| 342 | template, err := waf.Template() |
no test coverage detected