()
| 95 | |
| 96 | #[tokio::test] |
| 97 | async fn test_fuzz_query_messages() { |
| 98 | let inputs = generate_query_message_fuzzing(); |
| 99 | |
| 100 | for input in inputs { |
| 101 | let result = parse_query_message_safely(&input).await; |
| 102 | |
| 103 | match result { |
| 104 | Ok(query_msg) => { |
| 105 | // Query should have reasonable length limits |
| 106 | if let FrontendMessage::Query(sql) = query_msg { |
| 107 | assert!(sql.len() <= 1_000_000); // 1MB max |
| 108 | |
| 109 | // Should not contain obvious SQL injection patterns |
| 110 | let sql_lower = sql.to_lowercase(); |
| 111 | if sql_lower.contains("drop table") || |
| 112 | sql_lower.contains("delete from") || |
| 113 | sql_lower.contains("truncate") { |
| 114 | // Log potential malicious query for security audit |
| 115 | events::sql_injection_attempt( |
| 116 | None, |
| 117 | None, |
| 118 | &sql, |
| 119 | "Suspicious DDL/DML in fuzzing" |
| 120 | ); |
| 121 | } |
| 122 | } |
| 123 | } |
| 124 | Err(_) => { |
| 125 | // Error handling is acceptable |
| 126 | } |
| 127 | } |
| 128 | } |
| 129 | } |
| 130 | |
| 131 | #[tokio::test] |
| 132 | async fn test_fuzz_performance_degradation() { |
nothing calls this directly
no test coverage detected