core update from 7.37 to 7.38
This commit is contained in:
@@ -1414,10 +1414,47 @@ class DatabaseSelectTestCase extends DatabaseTestCase {
|
||||
}
|
||||
|
||||
$query = (string)$query;
|
||||
$expected = "/* Testing query comments SELECT nid FROM {node}; -- */ SELECT test.name AS name, test.age AS age\nFROM \n{test} test";
|
||||
$expected = "/* Testing query comments * / SELECT nid FROM {node}; -- */ SELECT test.name AS name, test.age AS age\nFROM \n{test} test";
|
||||
|
||||
$this->assertEqual($num_records, 4, 'Returned the correct number of rows.');
|
||||
$this->assertEqual($query, $expected, 'The flattened query contains the sanitised comment string.');
|
||||
|
||||
$connection = Database::getConnection();
|
||||
foreach ($this->makeCommentsProvider() as $test_set) {
|
||||
list($expected, $comments) = $test_set;
|
||||
$this->assertEqual($expected, $connection->makeComment($comments));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Provides expected and input values for testVulnerableComment().
|
||||
*/
|
||||
function makeCommentsProvider() {
|
||||
return array(
|
||||
array(
|
||||
'/* */ ',
|
||||
array(''),
|
||||
),
|
||||
// Try and close the comment early.
|
||||
array(
|
||||
'/* Exploit * / DROP TABLE node; -- */ ',
|
||||
array('Exploit */ DROP TABLE node; --'),
|
||||
),
|
||||
// Variations on comment closing.
|
||||
array(
|
||||
'/* Exploit * / * / DROP TABLE node; -- */ ',
|
||||
array('Exploit */*/ DROP TABLE node; --'),
|
||||
),
|
||||
array(
|
||||
'/* Exploit * * // DROP TABLE node; -- */ ',
|
||||
array('Exploit **// DROP TABLE node; --'),
|
||||
),
|
||||
// Try closing the comment in the second string which is appended.
|
||||
array(
|
||||
'/* Exploit * / DROP TABLE node; --; Another try * / DROP TABLE node; -- */ ',
|
||||
array('Exploit */ DROP TABLE node; --', 'Another try */ DROP TABLE node; --'),
|
||||
),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
Reference in New Issue
Block a user