Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Tests for union based sql injection #444

Merged
merged 6 commits into from
Sep 15, 2023
Merged

Tests for union based sql injection #444

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
e436278
Add first version of unit tests for union based sql injection vulnera…
May 31, 2023
d3b8f30
Added tests for the UnionBasedSQLInjction
000panther Sep 12, 2023
d7ba0a5
Cleanup
000panther Sep 12, 2023
10dd8bb
Cleanup, resolve some issues from review.
000panther Sep 14, 2023
b2e8e05
SpotlessApply
000panther Sep 14, 2023
9a75a1d
Move setup to top of tests
000panther Sep 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
80 changes: 28 additions & 52 deletions ...org/sasanlabs/service/vulnerability/sqlInjection/UnionBasedSQLInjectionVulnerability.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
package org.sasanlabs.service.vulnerability.sqlInjection;

import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.Map;
import org.sasanlabs.internal.utility.LevelConstants;
import org.sasanlabs.internal.utility.Variant;
Expand All @@ -25,10 +27,10 @@
value = "UnionBasedSQLInjectionVulnerability")
public class UnionBasedSQLInjectionVulnerability {

private JdbcTemplate applicationJdbcTemplate;
private final JdbcTemplate applicationJdbcTemplate;

public UnionBasedSQLInjectionVulnerability(
@Qualifier("applicationJdbcTemplate") JdbcTemplate applicationJdbcTemplate) {
@Qualifier("applicationJdbcTemplate") final JdbcTemplate applicationJdbcTemplate) {
this.applicationJdbcTemplate = applicationJdbcTemplate;
}

Expand All @@ -40,19 +42,10 @@ public UnionBasedSQLInjectionVulnerability(
value = LevelConstants.LEVEL_1,
htmlTemplate = "LEVEL_1/SQLInjection_Level1")
public ResponseEntity<CarInformation> getCarInformationLevel1(
@RequestParam Map<String, String> queryParams) {
String id = queryParams.get("id");
@RequestParam final Map<String, String> queryParams) {
final String id = queryParams.get("id");
return applicationJdbcTemplate.query(
"select * from cars where id=" + id,
(rs) -> {
CarInformation carInformation = new CarInformation();
if (rs.next()) {
carInformation.setId(rs.getInt(1));
carInformation.setName(rs.getString(2));
carInformation.setImagePath(rs.getString(3));
}
return new ResponseEntity<CarInformation>(carInformation, HttpStatus.OK);
});
"select * from cars where id=" + id, this::resultSetToResponse);
}

@AttackVector(
Expand All @@ -64,19 +57,10 @@ public ResponseEntity<CarInformation> getCarInformationLevel1(
value = LevelConstants.LEVEL_2,
htmlTemplate = "LEVEL_1/SQLInjection_Level1")
public ResponseEntity<CarInformation> getCarInformationLevel2(
@RequestParam Map<String, String> queryParams) {
String id = queryParams.get("id");
CarInformation carInformation = new CarInformation();
@RequestParam final Map<String, String> queryParams) {
final String id = queryParams.get("id");
return applicationJdbcTemplate.query(
"select * from cars where id='" + id + "'",
(rs) -> {
if (rs.next()) {
carInformation.setId(rs.getInt(1));
carInformation.setName(rs.getString(2));
carInformation.setImagePath(rs.getString(3));
}
return new ResponseEntity<CarInformation>(carInformation, HttpStatus.OK);
});
"select * from cars where id='" + id + "'", this::resultSetToResponse);
}

@AttackVector(
Expand All @@ -88,42 +72,34 @@ public ResponseEntity<CarInformation> getCarInformationLevel2(
variant = Variant.SECURE,
htmlTemplate = "LEVEL_1/SQLInjection_Level1")
public ResponseEntity<CarInformation> getCarInformationLevel3(
@RequestParam Map<String, String> queryParams) {
String id = queryParams.get("id").replaceAll("'", "");
@RequestParam final Map<String, String> queryParams) {
final String id = queryParams.get("id").replaceAll("'", "");
return applicationJdbcTemplate.query(
"select * from cars where id='" + id + "'",
(rs) -> {
CarInformation carInformation = new CarInformation();
if (rs.next()) {
carInformation.setId(rs.getInt(1));
carInformation.setName(rs.getString(2));
carInformation.setImagePath(rs.getString(3));
}
return new ResponseEntity<CarInformation>(carInformation, HttpStatus.OK);
});
"select * from cars where id='" + id + "'", this::resultSetToResponse);
}

@VulnerableAppRequestMapping(
value = LevelConstants.LEVEL_4,
variant = Variant.SECURE,
htmlTemplate = "LEVEL_1/SQLInjection_Level1")
public ResponseEntity<CarInformation> getCarInformationLevel4(
@RequestParam Map<String, String> queryParams) {
String id = queryParams.get("id");
@RequestParam final Map<String, String> queryParams) {
final String id = queryParams.get("id");

return applicationJdbcTemplate.query(
"select * from cars where id=?",
(prepareStatement) -> {
prepareStatement.setString(1, id);
},
(rs) -> {
CarInformation carInformation = new CarInformation();
if (rs.next()) {
carInformation.setId(rs.getInt(1));
carInformation.setName(rs.getString(2));
carInformation.setImagePath(rs.getString(3));
}
return new ResponseEntity<CarInformation>(carInformation, HttpStatus.OK);
});
prepareStatement -> prepareStatement.setString(1, id),
this::resultSetToResponse);
}

private ResponseEntity<CarInformation> resultSetToResponse(final ResultSet rs)
throws SQLException {
final CarInformation carInformation = new CarInformation();
if (rs.next()) {
carInformation.setId(rs.getInt(1));
carInformation.setName(rs.getString(2));
carInformation.setImagePath(rs.getString(3));
}
return new ResponseEntity<>(carInformation, HttpStatus.OK);
}
}
98 changes: 98 additions & 0 deletions ...sasanlabs/service/vulnerability/sqlInjection/UnionBasedSQLInjectionVulnerabilityTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,98 @@
package org.sasanlabs.service.vulnerability.sqlInjection;

import static org.mockito.ArgumentMatchers.any;
import static org.mockito.ArgumentMatchers.anyString;
import static org.mockito.ArgumentMatchers.eq;
import static org.mockito.Mockito.doReturn;
import static org.mockito.Mockito.verify;

import java.io.IOException;
import java.util.Collections;
import java.util.Map;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.mockito.Mockito;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.jdbc.core.PreparedStatementSetter;
import org.springframework.jdbc.core.ResultSetExtractor;

class UnionBasedSQLInjectionVulnerabilityTest {

private UnionBasedSQLInjectionVulnerability unionBasedSQLInjectionVulnerability;
private JdbcTemplate template;

@BeforeEach
void setUp() throws IOException {
template = Mockito.mock(JdbcTemplate.class);

// mock database
doReturn(null)
.when(template)
.query(anyString(), (ResultSetExtractor<? extends Object>) any());
doReturn(null)
.when(template)
.query(
anyString(),
(PreparedStatementSetter) any(),
(ResultSetExtractor<? extends Object>) any());

unionBasedSQLInjectionVulnerability = new UnionBasedSQLInjectionVulnerability(template);
}

@Test
void getCarInformationLevel1_ExpectParamInjected() throws IOException {
// Act
final Map<String, String> params =
Collections.singletonMap("id", "1 UNION SELECT * FROM cars;");
unionBasedSQLInjectionVulnerability.getCarInformationLevel1(params);

// Assert
verify(template)
.query(
eq("select * from cars where id=1 UNION SELECT * FROM cars;"),
(ResultSetExtractor<? extends Object>) any());
}

@Test
void getCarInformationLevel2_ExpectParamInjected() throws IOException {
// Act
final Map<String, String> params =
Collections.singletonMap("id", "1' UNION SELECT * FROM cars; --");
unionBasedSQLInjectionVulnerability.getCarInformationLevel2(params);

// Assert
verify(template)
.query(
eq("select * from cars where id='1' UNION SELECT * FROM cars; --'"),
(ResultSetExtractor<? extends Object>) any());
}

@Test
void getCarInformationLevel3_ExpectParamEscaped() throws IOException {
// Act
final Map<String, String> params =
Collections.singletonMap("id", "1' UNION SELECT * FROM cars; --");
unionBasedSQLInjectionVulnerability.getCarInformationLevel3(params);

// Assert
verify(template)
.query(
eq("select * from cars where id='1 UNION SELECT * FROM cars; --'"),
(ResultSetExtractor<? extends Object>) any());
}

@Test
void getCarInformationLevel4_ExpecParamEscaped() throws IOException {
// Act
final Map<String, String> params =
Collections.singletonMap("id", "1' UNION SELECT * FROM cars; --");
unionBasedSQLInjectionVulnerability.getCarInformationLevel4(params);

// Assert
verify(template)
.query(
eq("select * from cars where id=?"),
(PreparedStatementSetter) any(),
(ResultSetExtractor<? extends Object>) any());
}
}