(t *testing.T)
| 385 | } |
| 386 | |
| 387 | func TestScanSQL_OutOfBandPatterns(t *testing.T) { |
| 388 | scanner := NewScanner() |
| 389 | |
| 390 | testCases := []string{ |
| 391 | "EXEC xp_cmdshell 'dir'", |
| 392 | "SELECT LOAD_FILE('/etc/passwd')", |
| 393 | "SELECT * INTO OUTFILE '/tmp/data.txt'", |
| 394 | "SELECT * INTO DUMPFILE '/tmp/shell.php'", |
| 395 | } |
| 396 | |
| 397 | for _, sql := range testCases { |
| 398 | result := scanner.ScanSQL(sql) |
| 399 | hasOutOfBand := false |
| 400 | for _, f := range result.Findings { |
| 401 | if f.Pattern == PatternOutOfBand { |
| 402 | hasOutOfBand = true |
| 403 | break |
| 404 | } |
| 405 | } |
| 406 | |
| 407 | if !hasOutOfBand { |
| 408 | t.Errorf("expected out-of-band pattern in: %s", sql) |
| 409 | } |
| 410 | } |
| 411 | } |
| 412 | |
| 413 | func TestSeverityFiltering(t *testing.T) { |
| 414 | // Create scanner that only includes HIGH and above |
nothing calls this directly
no test coverage detected