-
Notifications
You must be signed in to change notification settings - Fork 95
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
CMR 9430: Fix SQL Injection Vulnerabilities in CMR Metadata App in pr…
…ovider and collection files (#1969) * fix provider ns * add validate func and unit tests * adding collection table unit tests * exchange are for are3 * update import name jdbc
- Loading branch information
Showing
5 changed files
with
159 additions
and
19 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
92 changes: 92 additions & 0 deletions
92
metadata-db-app/test/cmr/metadata_db/test/data/oracle/collection_table.clj
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,92 @@ | ||
| (ns cmr.metadata-db.test.data.oracle.collection-table | ||
| (:require | ||
| [clojure.test :refer :all] | ||
| [cmr.metadata-db.data.oracle.collection-table :as ct] | ||
| [cmr.common.util :as util :refer [are3]])) | ||
|
|
||
| (deftest collection-constraint-sql-false-test | ||
| (testing "valid table name" | ||
| (are3 [table-name query] | ||
| (let [non-small-provider {:provider-id "PROV1", :short-name "test provider", :cmr-only false, :small false}] | ||
| (is (= query (ct/collection-constraint-sql non-small-provider table-name)))) | ||
|
|
||
| "valid table name" | ||
| "table_name" | ||
| "CONSTRAINT table_name_pk PRIMARY KEY (id), CONSTRAINT table_name_con_rev\n UNIQUE (native_id, revision_id)\n USING INDEX (create unique index table_name_ucr_i\n ON table_name(native_id, revision_id)), CONSTRAINT table_name_cid_rev\n UNIQUE (concept_id, revision_id)\n USING INDEX (create unique index table_name_cri\n ON table_name(concept_id, revision_id))" | ||
|
|
||
| "valid table name with numbers" | ||
| "table_123_valid" | ||
| "CONSTRAINT table_123_valid_pk PRIMARY KEY (id), CONSTRAINT table_123_valid_con_rev\n UNIQUE (native_id, revision_id)\n USING INDEX (create unique index table_123_valid_ucr_i\n ON table_123_valid(native_id, revision_id)), CONSTRAINT table_123_valid_cid_rev\n UNIQUE (concept_id, revision_id)\n USING INDEX (create unique index table_123_valid_cri\n ON table_123_valid(concept_id, revision_id))")) | ||
| (testing "invalid table name" | ||
| (are3 [table-name query] | ||
| (let [non-small-provider {:provider-id "PROV1", :short-name "test provider", :cmr-only false, :small false}] | ||
| (is (thrown? Exception (ct/collection-constraint-sql non-small-provider table-name)))) | ||
|
|
||
| "invalid table name" | ||
| "table_name--;" | ||
| true | ||
|
|
||
| "invalid table name 2" | ||
| "table_; DELETE" | ||
| true))) | ||
|
|
||
| (deftest collection-constraint-sql-true-test | ||
| (testing "valid table name" | ||
| (are3 [table-name query] | ||
| (let [small-provider {:provider-id "PROV1", :short-name "test provider", :cmr-only false, :small true}] | ||
| (is (= query (ct/collection-constraint-sql small-provider table-name)))) | ||
|
|
||
| "valid table name" | ||
| "table_name" | ||
| "CONSTRAINT table_name_pk PRIMARY KEY (id), CONSTRAINT table_name_con_rev\n UNIQUE (provider_id, native_id, revision_id)\n USING INDEX (create unique index table_name_ucr_i\n ON table_name(provider_id, native_id, revision_id)), CONSTRAINT table_name_cid_rev\n UNIQUE (concept_id, revision_id)\n USING INDEX (create unique index table_name_cri\n ON table_name(concept_id, revision_id))", | ||
|
|
||
| "valid table name with numbers" | ||
| "table_123_valid" | ||
| "CONSTRAINT table_123_valid_pk PRIMARY KEY (id), CONSTRAINT table_123_valid_con_rev\n UNIQUE (provider_id, native_id, revision_id)\n USING INDEX (create unique index table_123_valid_ucr_i\n ON table_123_valid(provider_id, native_id, revision_id)), CONSTRAINT table_123_valid_cid_rev\n UNIQUE (concept_id, revision_id)\n USING INDEX (create unique index table_123_valid_cri\n ON table_123_valid(concept_id, revision_id))")) | ||
| (testing "invalid table name" | ||
| (are3 [table-name] | ||
| (let [small-provider {:provider-id "PROV1", :short-name "test provider", :cmr-only false, :small true}] | ||
| (is (thrown? Exception (ct/collection-constraint-sql small-provider table-name)))) | ||
|
|
||
| "invalid table name" | ||
| "table_name--;" | ||
| true | ||
|
|
||
| "invalid table name 2" | ||
| "table_; DELETE" | ||
| true))) | ||
|
|
||
| (deftest create-collection-indexes-false-test | ||
| (testing "invalid table name" | ||
| (let [non-small-provider {:provider-id "PROV1", :short-name "test provider", :cmr-only false, :small false}] | ||
| (are [table-name] (thrown? Exception (ct/create-collection-indexes nil non-small-provider table-name)) | ||
| "table_name--;" | ||
| "table_; DELETE")))) | ||
|
|
||
| (deftest create-collection-indexes-false-test | ||
| (testing "invalid table name" | ||
| (are3 [table-name] | ||
| (let [non-small-provider {:provider-id "PROV1", :short-name "test provider", :cmr-only false, :small false}] | ||
| (is (thrown? Exception (ct/create-collection-indexes nil non-small-provider table-name)))) | ||
|
|
||
| "invalid table name" | ||
| "table_name--;" | ||
| true | ||
|
|
||
| "invalid table name 2" | ||
| "table_; DELETE" | ||
| true))) | ||
|
|
||
| (deftest create-collection-indexes-true-test | ||
| (testing "invalid table name" | ||
| (are3 [table-name] | ||
| (let [small-provider {:provider-id "PROV1", :short-name "test provider", :cmr-only false, :small true}] | ||
| (is (thrown? Exception (ct/create-collection-indexes nil small-provider table-name)))) | ||
|
|
||
| "invalid table name" | ||
| "table_name--;" | ||
| true | ||
|
|
||
| "invalid table name 2" | ||
| "table_; DELETE" | ||
| true))) |
37 changes: 37 additions & 0 deletions
37
metadata-db-app/test/cmr/metadata_db/test/data/oracle/util.clj
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| (ns cmr.metadata-db.test.data.oracle.util | ||
| (:require | ||
| [clojure.test :refer :all] | ||
| [cmr.metadata-db.data.util :as data_util] | ||
| [cmr.common.util :as common_util :refer [are3]])) | ||
|
|
||
| (deftest validate-table-name-test | ||
| (testing "correct table name given" | ||
| (are3 [table-name result] | ||
| (is (= nil (data_util/validate-table-name table-name))) | ||
|
|
||
| "valid table name with only underscore" | ||
| "table_name" | ||
| true | ||
|
|
||
| "valid table name with numbers and underscores" | ||
| "123table_name" | ||
| true | ||
|
|
||
| "valid table name with multiple underscores" | ||
| "table_name_" | ||
| true)) | ||
| (testing "incorrect table name given" | ||
| (are3 [table-name result] | ||
| (is (thrown? Exception (data_util/validate-table-name table-name))) | ||
|
|
||
| "invalid table name" | ||
| "table-name" | ||
| true | ||
|
|
||
| "invalid table name 2" | ||
| "; -- comment" | ||
| true | ||
|
|
||
| "invalid table name 3" | ||
| "; DELETE" | ||
| true))) |