Function TestSQLAnalyzer_UpdateStatements

cmd/gosqlx/cmd/sql_analyzer_test.go:525–582

TestSQLAnalyzer_UpdateStatements tests analysis of UPDATE statements

(t *testing.T)

// TestSQLAnalyzer_UpdateStatements tests analysis of UPDATE statements
func TestSQLAnalyzer_UpdateStatements(t *testing.T) {
	tests := []struct {
		name                string
		sql                 string
		expectedMinSecScore int
	}{
		{
			name:                "UPDATE with WHERE",
			sql:                 "UPDATE users SET active = true WHERE id = 1",
			expectedMinSecScore: 70,
		},
		{
			name:                "UPDATE with complex WHERE",
			sql:                 "UPDATE users SET status = 'active' WHERE created_at < '2023-01-01' AND verified = true",
			expectedMinSecScore: 70,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			tkz := tokenizer.GetTokenizer()
			defer tokenizer.PutTokenizer(tkz)

			tokens, err := tkz.Tokenize([]byte(tt.sql))
			if err != nil {
				t.Fatalf("Tokenization failed: %v", err)
			}

			p := parser.NewParser()
			astObj := ast.NewAST()
			defer ast.ReleaseAST(astObj)

			result, err := p.ParseFromModelTokens(tokens)
			if err != nil {
				t.Skipf("Parsing failed (expected for incomplete parser support): %v", err)
				return
			}
			astObj.Statements = result.Statements

			analyzer := NewSQLAnalyzer()
			report, err := analyzer.Analyze(astObj)
			if err != nil {
				t.Fatalf("Analysis failed: %v", err)
			}

			// Basic validations
			if report == nil {
				t.Fatal("Expected report but got nil")
			}

			// Check security score is reasonable
			if report.SecurityScore < tt.expectedMinSecScore {
				t.Errorf("Security score too low: expected >= %d, got %d",
					tt.expectedMinSecScore, report.SecurityScore)
			}
		})
	}
}