40 lines
1.2 KiB
Go
40 lines
1.2 KiB
Go
package app
|
|
|
|
import (
|
|
"encoding/json"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestUserTypeFilters(t *testing.T) {
|
|
for _, item := range []struct{ kind, expected string }{{"", ""}, {"test", " AND u.is_test=1"}, {"registered", " AND u.is_test=0"}} {
|
|
where, args, err := testUserFilter(item.kind, "")
|
|
if err != nil || where != item.expected || len(args) != 0 {
|
|
t.Fatalf("filter %q: %q %v %v", item.kind, where, args, err)
|
|
}
|
|
}
|
|
if _, _, err := testUserFilter("invalid", ""); err == nil {
|
|
t.Fatal("invalid type accepted")
|
|
}
|
|
if _, _, err := testUserFilter("", strings.Repeat("x", 65)); err == nil {
|
|
t.Fatal("oversized batch accepted")
|
|
}
|
|
batch := "' OR 1=1 --"
|
|
where, args, err := testUserFilter("test", batch)
|
|
if err != nil || strings.Contains(where, batch) || !strings.Contains(where, "u.test_batch=?") || len(args) != 1 || args[0] != batch {
|
|
t.Fatal("batch must be an exact bound SQL value")
|
|
}
|
|
}
|
|
|
|
func TestPublicProfileDoesNotExposeTestMetadata(t *testing.T) {
|
|
data, err := json.Marshal(profileView{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var result map[string]any
|
|
_ = json.Unmarshal(data, &result)
|
|
if _, exists := result["isTest"]; exists {
|
|
t.Fatalf("public profile exposed internal account metadata: %s", data)
|
|
}
|
|
}
|