提交 fe177f1b 编写于 作者: J Justin Collins

Add test for model name including an underline

上级 0d61d9eb
class Underline_Model
def inject!(b)
User.where("a < #{b}")
end
end
......@@ -15,7 +15,7 @@ class Rails3Tests < Test::Unit::TestCase
:controller => 1,
:model => 8,
:template => 36,
:warning => 53
:warning => 54
}
if RUBY_PLATFORM == 'java'
......@@ -557,6 +557,16 @@ class Rails3Tests < Test::Unit::TestCase
:file => /user\.rb/
end
def test_sqli_in_unusual_model_name
assert_warning :type => :warning,
:warning_code => 0,
:warning_type => "SQL Injection",
:line => 3,
:message => /^Possible\ SQL\ injection/,
:confidence => 1,
:file => /underline_model\.rb/
end
def test_escape_once
results = find :type => :template,
:warning_type => "Cross Site Scripting",
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册