Function TestSQLAnalyzer_MixedStatements

cmd/gosqlx/cmd/sql_analyzer_test.go:669–722

TestSQLAnalyzer_MixedStatements tests analysis with multiple statement types

(t *testing.T)

// TestSQLAnalyzer_MixedStatements tests analysis with multiple statement types
func TestSQLAnalyzer_MixedStatements(t *testing.T) {
	tests := []struct {
		name              string
		sql               string
		expectedStmtCount int
		expectedMinScore  int
	}{
		{
			name:              "SELECT and INSERT",
			sql:               "SELECT * FROM users; INSERT INTO logs (message) VALUES ('test')",
			expectedStmtCount: 2,
			expectedMinScore:  60,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			tkz := tokenizer.GetTokenizer()
			defer tokenizer.PutTokenizer(tkz)

			tokens, err := tkz.Tokenize([]byte(tt.sql))
			if err != nil {
				t.Fatalf("Tokenization failed: %v", err)
			}

			p := parser.NewParser()
			astObj := ast.NewAST()
			defer ast.ReleaseAST(astObj)

			result, err := p.ParseFromModelTokens(tokens)
			if err != nil {
				t.Skipf("Parsing failed (parser doesn't support multiple statements yet): %v", err)
				return
			}
			astObj.Statements = result.Statements

			analyzer := NewSQLAnalyzer()
			report, err := analyzer.Analyze(astObj)
			if err != nil {
				t.Fatalf("Analysis failed: %v", err)
			}

			if report.Query.StatementCount != tt.expectedStmtCount {
				t.Errorf("Expected StatementCount=%d, got %d",
					tt.expectedStmtCount, report.Query.StatementCount)
			}

			if report.SecurityScore < tt.expectedMinScore {
				t.Errorf("Security score too low: expected >= %d, got %d",
					tt.expectedMinScore, report.SecurityScore)
			}
		})
	}
}

// TestSQLAnalyzer_SecurityScannerIntegration tests that the security scanner
// integration is working correctly to detect SQL injection patterns