@@ -62,3 +62,39 @@ def test_not_in_userinput_not_injection():
6262
6363def test_injection_with_maths ():
6464 is_injection ("1 + 2 + (3 // 4)" , "(3 // 4)" )
65+
66+
67+ def test_simple_injections ():
68+ is_injection ("os.system('ls')" , "os.system('ls')" )
69+ is_injection ("exec('print(1)')" , "exec('print(1)')" )
70+ is_injection ("eval('2 + 2')" , "eval('2 + 2')" )
71+ is_injection (
72+ "__import__('os').system('rm -rf /')" , "__import__('os').system('rm -rf /')"
73+ )
74+
75+
76+ def test_string_injections ():
77+ is_injection ("print('Hello, World!')" )
78+ is_injection ("input('Enter your name: ')" )
79+ is_injection ("os.system('rm -rf /');" )
80+
81+
82+ def test_nested_injections ():
83+ is_injection ("eval('print(1)')" )
84+ is_injection ("eval('os.system('ls')')" )
85+ is_injection ("exec('print(2)')" )
86+ is_injection ("exec('os.system('ls')')" )
87+
88+
89+ def test_edge_cases ():
90+ is_injection ("a = 1; b = 2" )
91+ is_injection ("b = 2; os.system('ls')" )
92+ is_injection ("def f(): pass" )
93+ is_injection ("f(); os.system('ls')" )
94+
95+
96+ def test_injection_with_special_characters ():
97+ is_injection ("print('Hello!')" )
98+ is_injection ("rm -rf /; #" )
99+ is_injection ("print('Goodbye!')" )
100+ is_injection ("echo 'Hacked!'; #" )
0 commit comments