bachir/performance-art.fr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

updated core to 7.73

Browse Source
This commit is contained in:
bachir
2020-09-24 17:04:08 +02:00
parent 084d28842a
commit 7d87153100
524 changed files with 25194 additions and 7745 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/simpletest/tests/database_test.test
+163 -10
View File
@@ -23,6 +23,7 @@ class DatabaseTestCase extends DrupalWebTestCase {
$schema['test'] = drupal_get_schema('test');
$schema['test_people'] = drupal_get_schema('test_people');
$schema['test_people_copy'] = drupal_get_schema('test_people_copy');
$schema['test_one_blob'] = drupal_get_schema('test_one_blob');
$schema['test_two_blobs'] = drupal_get_schema('test_two_blobs');
$schema['test_task'] = drupal_get_schema('test_task');
@@ -237,7 +238,7 @@ class DatabaseConnectionTestCase extends DatabaseTestCase {
// Open the default target so we have an object to compare.
$db1 = Database::getConnection('default', 'default');
// Try to close the the default connection, then open a new one.
// Try to close the default connection, then open a new one.
Database::closeConnection('default', 'default');
$db2 = Database::getConnection('default', 'default');
@@ -603,9 +604,9 @@ class DatabaseInsertTestCase extends DatabaseTestCase {
}
/**
* Test that the INSERT INTO ... SELECT ... syntax works.
* Test that the INSERT INTO ... SELECT (fields) ... syntax works.
*/
function testInsertSelect() {
function testInsertSelectFields() {
$query = db_select('test_people', 'tp');
// The query builder will always append expressions after fields.
// Add the expression first to test that the insert fields are correctly
@@ -627,6 +628,27 @@ class DatabaseInsertTestCase extends DatabaseTestCase {
$saved_age = db_query('SELECT age FROM {test} WHERE name = :name', array(':name' => 'Meredith'))->fetchField();
$this->assertIdentical($saved_age, '30', 'Can retrieve after inserting.');
}
/**
* Tests that the INSERT INTO ... SELECT * ... syntax works.
*/
function testInsertSelectAll() {
$query = db_select('test_people', 'tp')
->fields('tp')
->condition('tp.name', 'Meredith');
// The resulting query should be equivalent to:
// INSERT INTO test_people_copy
// SELECT *
// FROM test_people tp
// WHERE tp.name = 'Meredith'
db_insert('test_people_copy')
->from($query)
->execute();
$saved_age = db_query('SELECT age FROM {test_people_copy} WHERE name = :name', array(':name' => 'Meredith'))->fetchField();
$this->assertIdentical($saved_age, '30', 'Can retrieve after inserting.');
}
}
/**
@@ -1392,10 +1414,47 @@ class DatabaseSelectTestCase extends DatabaseTestCase {
}
$query = (string)$query;
$expected = "/* Testing query comments SELECT nid FROM {node}; -- */ SELECT test.name AS name, test.age AS age\nFROM \n{test} test";
$expected = "/* Testing query comments * / SELECT nid FROM {node}; -- */ SELECT test.name AS name, test.age AS age\nFROM \n{test} test";
$this->assertEqual($num_records, 4, 'Returned the correct number of rows.');
$this->assertEqual($query, $expected, 'The flattened query contains the sanitised comment string.');
$connection = Database::getConnection();
foreach ($this->makeCommentsProvider() as $test_set) {
list($expected, $comments) = $test_set;
$this->assertEqual($expected, $connection->makeComment($comments));
}
}
/**
* Provides expected and input values for testVulnerableComment().
*/
function makeCommentsProvider() {
return array(
array(
'/* */ ',
array(''),
),
// Try and close the comment early.
array(
'/* Exploit * / DROP TABLE node; -- */ ',
array('Exploit */ DROP TABLE node; --'),
),
// Variations on comment closing.
array(
'/* Exploit * / * / DROP TABLE node; -- */ ',
array('Exploit */*/ DROP TABLE node; --'),
),
array(
'/* Exploit * * // DROP TABLE node; -- */ ',
array('Exploit **// DROP TABLE node; --'),
),
// Try closing the comment in the second string which is appended.
array(
'/* Exploit * / DROP TABLE node; --; Another try * / DROP TABLE node; -- */ ',
array('Exploit */ DROP TABLE node; --', 'Another try */ DROP TABLE node; --'),
),
);
}
/**
@@ -1925,6 +1984,15 @@ class DatabaseSelectOrderedTestCase extends DatabaseTestCase {
$this->assertEqual($num_records, 4, 'Returned the correct number of rows.');
}
/**
* Tests that the sort direction is sanitized properly.
*/
function testOrderByEscaping() {
$query = db_select('test')->orderBy('name', 'invalid direction');
$order_bys = $query->getOrderBy();
$this->assertEqual($order_bys['name'], 'ASC', 'Invalid order by direction is converted to ASC.');
}
}
/**
@@ -2599,6 +2667,52 @@ class DatabaseTaggingTestCase extends DatabaseTestCase {
$this->assertFalse($query->hasAnyTag('other', 'stuff'), 'hasAnyTag() returned false.');
}
/**
* Confirm that an extended query has a "tag" added to it.
*/
function testExtenderHasTag() {
$query = db_select('test')
->extend('SelectQueryExtender');
$query->addField('test', 'name');
$query->addField('test', 'age', 'age');
$query->addTag('test');
$this->assertTrue($query->hasTag('test'), 'hasTag() returned true.');
$this->assertFalse($query->hasTag('other'), 'hasTag() returned false.');
}
/**
* Test extended query tagging "has all of these tags" functionality.
*/
function testExtenderHasAllTags() {
$query = db_select('test')
->extend('SelectQueryExtender');
$query->addField('test', 'name');
$query->addField('test', 'age', 'age');
$query->addTag('test');
$query->addTag('other');
$this->assertTrue($query->hasAllTags('test', 'other'), 'hasAllTags() returned true.');
$this->assertFalse($query->hasAllTags('test', 'stuff'), 'hasAllTags() returned false.');
}
/**
* Test extended query tagging "has at least one of these tags" functionality.
*/
function testExtenderHasAnyTag() {
$query = db_select('test')
->extend('SelectQueryExtender');
$query->addField('test', 'name');
$query->addField('test', 'age', 'age');
$query->addTag('test');
$this->assertTrue($query->hasAnyTag('test', 'other'), 'hasAnyTag() returned true.');
$this->assertFalse($query->hasAnyTag('other', 'stuff'), 'hasAnyTag() returned false.');
}
/**
* Test that we can attach meta data to a query object.
*
@@ -3069,6 +3183,15 @@ class DatabaseTemporaryQueryTestCase extends DrupalWebTestCase {
$this->assertEqual($this->countTableRows($table_name_system), $this->countTableRows("system"), 'A temporary table was created successfully in this request.');
$this->assertEqual($this->countTableRows($table_name_users), $this->countTableRows("users"), 'A second temporary table was created successfully in this request.');
// Check that leading whitespace and comments do not cause problems
// in the modified query.
$sql = "
-- Let's select some rows into a temporary table
SELECT name FROM {test}
";
$table_name_test = db_query_temporary($sql, array());
$this->assertEqual($this->countTableRows($table_name_test), $this->countTableRows('test'), 'Leading white space and comments do not interfere with temporary table creation.');
}
}
@@ -3307,6 +3430,34 @@ class DatabaseQueryTestCase extends DatabaseTestCase {
$this->assertEqual(count($names), 3, 'Correct number of names returned');
}
/**
* Test SQL injection via database query array arguments.
*/
public function testArrayArgumentsSQLInjection() {
// Attempt SQL injection and verify that it does not work.
$condition = array(
"1 ;INSERT INTO {test} (name) VALUES ('test12345678'); -- " => '',
'1' => '',
);
try {
db_query("SELECT * FROM {test} WHERE name = :name", array(':name' => $condition))->fetchObject();
$this->fail('SQL injection attempt via array arguments should result in a PDOException.');
}
catch (PDOException $e) {
$this->pass('SQL injection attempt via array arguments should result in a PDOException.');
}
// Test that the insert query that was used in the SQL injection attempt did
// not result in a row being inserted in the database.
$result = db_select('test')
->condition('name', 'test12345678')
->countQuery()
->execute()
->fetchField();
$this->assertFalse($result, 'SQL injection attempt did not result in a row being inserted in the database table.');
}
}
/**
@@ -3340,12 +3491,14 @@ class DatabaseTransactionTestCase extends DatabaseTestCase {
}
/**
* Helper method for transaction unit test. This "outer layer" transaction
* starts and then encapsulates the "inner layer" transaction. This nesting
* is used to evaluate whether the the database transaction API properly
* supports nesting. By "properly supports," we mean the outer transaction
* continues to exist regardless of what functions are called and whether
* those functions start their own transactions.
* Helper method for transaction unit test.
*
* This "outer layer" transaction starts and then encapsulates the
* "inner layer" transaction. This nesting is used to evaluate whether the
* database transaction API properly supports nesting. By "properly supports,"
* we mean the outer transaction continues to exist regardless of what
* functions are called and whether those functions start their own
* transactions.
*
* In contrast, a typical database would commit the outer transaction, start
* a new transaction for the inner layer, commit the inner layer transaction,