43 lines
1.1 KiB
Go
43 lines
1.1 KiB
Go
|
package main
|
||
|
|
|
||
|
|
import "testing"
|
||
|
|
|
||
|
|
func TestQuoteMySQLIdent(t *testing.T) {
|
||
|
|
got, err := quoteMySQLIdent("order")
|
||
|
|
if err != nil || got != "`order`" {
|
||
|
|
t.Fatalf("order: got %q err=%v", got, err)
|
||
|
|
}
|
||
|
|
if _, err := quoteMySQLIdent("users; DROP TABLE x"); err == nil {
|
||
|
|
t.Fatal("expected reject for injection payload")
|
||
|
|
}
|
||
|
|
if _, err := quoteMySQLIdent("a-b"); err == nil {
|
||
|
|
t.Fatal("expected reject for hyphen")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestQuoteMySQLIdentPath(t *testing.T) {
|
||
|
|
got, err := quoteMySQLIdentPath("cf.company_id")
|
||
|
|
if err != nil || got != "`cf`.`company_id`" {
|
||
|
|
t.Fatalf("path: got %q err=%v", got, err)
|
||
|
|
}
|
||
|
|
if _, err := quoteMySQLIdentPath("cf.company_id;--"); err == nil {
|
||
|
|
t.Fatal("expected reject")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestQuotePGIdent(t *testing.T) {
|
||
|
|
got, err := quotePGIdent("companies")
|
||
|
|
if err != nil || got != `"companies"` {
|
||
|
|
t.Fatalf("got %q err=%v", got, err)
|
||
|
|
}
|
||
|
|
if _, err := quotePGIdent(`companies" OR 1=1`); err == nil {
|
||
|
|
t.Fatal("expected reject")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestMustQuoteMySQLIdent(t *testing.T) {
|
||
|
|
if got := mustQuoteMySQLIdent("key"); got != "`key`" {
|
||
|
|
t.Fatalf("got %q", got)
|
||
|
|
}
|
||
|
|
}
|