hana-cli/tests/utils/sqlInjection.Test.js

HANA Developer Command Line Interface

// @ts-nocheck
/**
 * @module SQLInjection Tests - Unit tests for SQL injection protection utilities
 */

import { assert } from '../base.js'
import * as sqlInjection from '../../utils/sqlInjection.js'

describe('SQL Injection Protection Utilities', function () {
    
    describe('whitespaceTable', function () {
        it('should contain standard whitespace characters', function () {
            assert.strictEqual(sqlInjection.whitespaceTable[' '], true)
            assert.strictEqual(sqlInjection.whitespaceTable['\t'], true)
            assert.strictEqual(sqlInjection.whitespaceTable['\n'], true)
            assert.strictEqual(sqlInjection.whitespaceTable['\r'], true)
        })

        it('should contain unicode whitespace characters', function () {
            assert.strictEqual(sqlInjection.whitespaceTable['\u00A0'], true)
            assert.strictEqual(sqlInjection.whitespaceTable['\u2000'], true)
        })
    })

    describe('separatorTable', function () {
        it('should contain common SQL separators', function () {
            assert.strictEqual(sqlInjection.separatorTable[','], true)
            assert.strictEqual(sqlInjection.separatorTable['('], true)
            assert.strictEqual(sqlInjection.separatorTable[')'], true)
            assert.strictEqual(sqlInjection.separatorTable[';'], true)
        })

        it('should contain SQL operators', function () {
            assert.strictEqual(sqlInjection.separatorTable['+'], true)
            assert.strictEqual(sqlInjection.separatorTable['-'], true)
            assert.strictEqual(sqlInjection.separatorTable['*'], true)
            assert.strictEqual(sqlInjection.separatorTable['/'], true)
            assert.strictEqual(sqlInjection.separatorTable['='], true)
        })
    })

    describe('isAcceptableQuotedParameter', function () {
        it('should accept strings without unmatched quotes', function () {
            assert.strictEqual(sqlInjection.isAcceptableQuotedParameter('normalstring'), true)
            assert.strictEqual(sqlInjection.isAcceptableQuotedParameter('normal string'), true)
            assert.strictEqual(sqlInjection.isAcceptableQuotedParameter('123'), true)
        })

        it('should reject strings with unmatched quotes', function () {
            assert.strictEqual(sqlInjection.isAcceptableQuotedParameter('test"value'), false)
            assert.strictEqual(sqlInjection.isAcceptableQuotedParameter('"test'), false)
            assert.strictEqual(sqlInjection.isAcceptableQuotedParameter('test"'), false)
        })

        it('should reject empty or non-string values', function () {
            assert.strictEqual(sqlInjection.isAcceptableQuotedParameter(''), false)
            assert.strictEqual(sqlInjection.isAcceptableQuotedParameter(null), false)
            assert.strictEqual(sqlInjection.isAcceptableQuotedParameter(undefined), false)
            assert.strictEqual(sqlInjection.isAcceptableQuotedParameter(123), false)
        })
    })

    describe('isAcceptableParameter', function () {
        it('should accept single token parameters', function () {
            assert.strictEqual(sqlInjection.isAcceptableParameter('TABLE_NAME'), true)
            assert.strictEqual(sqlInjection.isAcceptableParameter('USER123'), true)
            assert.strictEqual(sqlInjection.isAcceptableParameter('SCHEMA'), true)
        })

        it('should accept parameters with double quotes', function () {
            // Note: Quoted strings count as tokens, so need to specify maxToken appropriately
            assert.strictEqual(sqlInjection.isAcceptableParameter('"MY_TABLE"', 1), true)
            assert.strictEqual(sqlInjection.isAcceptableParameter('"Schema"."Table"', 3), true)
        })

        it('should reject SQL comments', function () {
            assert.strictEqual(sqlInjection.isAcceptableParameter('TABLE--comment'), false)
            assert.strictEqual(sqlInjection.isAcceptableParameter('TABLE/*comment*/'), false)
            assert.strictEqual(sqlInjection.isAcceptableParameter('--comment'), false)
        })

        it('should respect maxToken parameter', function () {
            assert.strictEqual(sqlInjection.isAcceptableParameter('one', 1), true)
            assert.strictEqual(sqlInjection.isAcceptableParameter('one two', 1), false)
            assert.strictEqual(sqlInjection.isAcceptableParameter('one two', 2), true)
            assert.strictEqual(sqlInjection.isAcceptableParameter('one, two', 3), true)
        })

        it('should reject empty or non-string values', function () {
            assert.strictEqual(sqlInjection.isAcceptableParameter(''), false)
            assert.strictEqual(sqlInjection.isAcceptableParameter(null), false)
            assert.strictEqual(sqlInjection.isAcceptableParameter(undefined), false)
            assert.strictEqual(sqlInjection.isAcceptableParameter(123), false)
        })

        it('should handle escaped double quotes', function () {
            assert.strictEqual(sqlInjection.isAcceptableParameter('"value""with""quotes"'), true)
        })

        it('should count tokens correctly with separators', function () {
            assert.strictEqual(sqlInjection.isAcceptableParameter('TABLE.COLUMN', 3), true)
            assert.strictEqual(sqlInjection.isAcceptableParameter('SCHEMA.TABLE', 3), true)
            assert.strictEqual(sqlInjection.isAcceptableParameter('(value)', 3), true)
        })

        it('should reject unclosed quotes', function () {
            assert.strictEqual(sqlInjection.isAcceptableParameter('"unclosed'), false)
            assert.strictEqual(sqlInjection.isAcceptableParameter('unclosed"'), false)
        })
    })

    describe('escapeDoubleQuotes', function () {
        it('should escape double quotes', function () {
            assert.strictEqual(sqlInjection.escapeDoubleQuotes('value'), 'value')
            assert.strictEqual(sqlInjection.escapeDoubleQuotes('my"value'), 'my""value')
            assert.strictEqual(sqlInjection.escapeDoubleQuotes('"test"'), '""test""')
        })

        it('should handle multiple double quotes', function () {
            assert.strictEqual(sqlInjection.escapeDoubleQuotes('a"b"c'), 'a""b""c')
            assert.strictEqual(sqlInjection.escapeDoubleQuotes('"""'), '""""""')
        })

        it('should handle strings without quotes', function () {
            assert.strictEqual(sqlInjection.escapeDoubleQuotes('normal string'), 'normal string')
        })
    })

    describe('escapeSingleQuotes', function () {
        it('should escape single quotes', function () {
            assert.strictEqual(sqlInjection.escapeSingleQuotes('value'), 'value')
            assert.strictEqual(sqlInjection.escapeSingleQuotes("my'value"), "my''value")
            assert.strictEqual(sqlInjection.escapeSingleQuotes("'test'"), "''test''")
        })

        it('should handle multiple single quotes', function () {
            assert.strictEqual(sqlInjection.escapeSingleQuotes("a'b'c"), "a''b''c")
            assert.strictEqual(sqlInjection.escapeSingleQuotes("'''"), "''''''")
        })

        it('should handle strings without quotes', function () {
            assert.strictEqual(sqlInjection.escapeSingleQuotes('normal string'), 'normal string')
        })
    })
})