diff --git a/src/main/java/org/sasanlabs/configuration/VulnerableAppConfiguration.java b/src/main/java/org/sasanlabs/configuration/VulnerableAppConfiguration.java index d892ab5b..132124da 100755 --- a/src/main/java/org/sasanlabs/configuration/VulnerableAppConfiguration.java +++ b/src/main/java/org/sasanlabs/configuration/VulnerableAppConfiguration.java @@ -157,7 +157,8 @@ protected MultipartResolver lookupMultipartResolver(HttpServletRequest request) return lookupMultipartResolver(); } } - }; + } + ; return new MaxUploadSizeOverrideMultipartFilter(); } } diff --git a/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerabilityTest.java index fc7759a1..5883c6af 100644 --- a/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerabilityTest.java +++ b/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerabilityTest.java @@ -20,186 +20,196 @@ public class BlindSQLInjectionVulnerabilityTest { - @Mock private JdbcTemplate jdbcTemplate; - - @InjectMocks private BlindSQLInjectionVulnerability blindSQLInjectionVulnerability; - - @BeforeEach - public void setUp() { - MockitoAnnotations.openMocks(this); - } - - @Test - public void testGetCarInformationLevel1_CarPresent() throws SQLException { - // Arrange - String id = "1"; - Map queryParams = new HashMap<>(); - queryParams.put("id", id); - - // The query is simulated to have returned a result (i.e. there is a car with ID "1") - ResultSet mockResultSet = mock(ResultSet.class); - when(mockResultSet.next()).thenReturn(true); - - // return rse.extractData(mockResultSet); indicates that the ResultSetExtractor extracts the - // data from the mockResultSet (which mocks the query result) - when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))) - .thenAnswer( - invocation -> { - ResultSetExtractor> rse = invocation.getArgument(1); - return rse.extractData(mockResultSet); - }); - - // Act - ResponseEntity response = - blindSQLInjectionVulnerability.getCarInformationLevel1(queryParams); - - // Assert - assertEquals(HttpStatus.OK, response.getStatusCode()); - assertEquals("{ \"isCarPresent\": true}", response.getBody()); - } - - @Test - public void testGetCarInformationLevel1_CarNotPresent() throws SQLException { - // Arrange - String id = "2"; - Map queryParams = new HashMap<>(); - queryParams.put("id", id); - - // The query is simulated to have returned a result (i.e. there is no a car with ID "2") - ResultSet mockResultSet = mock(ResultSet.class); - when(mockResultSet.next()).thenReturn(false); - - // return rse.extractData(mockResultSet); indicates that the ResultSetExtractor extracts the - // data from the mockResultSet (which mocks the query result) - when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))) - .thenAnswer( - invocation -> { - ResultSetExtractor> rse = invocation.getArgument(1); - return rse.extractData(mockResultSet); - }); - - // Act - ResponseEntity response = - blindSQLInjectionVulnerability.getCarInformationLevel1(queryParams); - - // Assert - assertEquals(HttpStatus.OK, response.getStatusCode()); - assertEquals( - ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE, response.getBody()); - } - - @Test - public void testGetCarInformationLevel2_CarPresent() throws SQLException { - // Arrange - String id = "1"; - Map queryParams = new HashMap<>(); - queryParams.put("id", id); - - // Mock the ResultSet behavior - ResultSet mockResultSet = mock(ResultSet.class); - when(mockResultSet.next()).thenReturn(true); - - // Mock the query method of JdbcTemplate - when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))) - .thenAnswer( - invocation -> { - ResultSetExtractor> rse = invocation.getArgument(1); - return rse.extractData(mockResultSet); - }); - - // Act - ResponseEntity response = - blindSQLInjectionVulnerability.getCarInformationLevel2(queryParams); - - // Assert - assertEquals(HttpStatus.OK, response.getStatusCode()); - assertEquals("{ \"isCarPresent\": true}", response.getBody()); - } - - @Test - public void testGetCarInformationLevel2_CarNotPresent() throws SQLException { - // Arrange - String id = "2"; - Map queryParams = new HashMap<>(); - queryParams.put("id", id); - - // Mock the ResultSet behavior - ResultSet mockResultSet = mock(ResultSet.class); - when(mockResultSet.next()).thenReturn(false); - - // Mock the query method of JdbcTemplate - when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))) - .thenAnswer( - invocation -> { - ResultSetExtractor> rse = invocation.getArgument(1); - return rse.extractData(mockResultSet); - }); - - // Act - ResponseEntity response = - blindSQLInjectionVulnerability.getCarInformationLevel2(queryParams); - - // Assert - assertEquals(HttpStatus.OK, response.getStatusCode()); - assertEquals( - ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE, response.getBody()); - } - - @Test - public void testGetCarInformationLevel3_CarPresent() throws SQLException { - // Arrange - String id = "1"; - Map queryParams = new HashMap<>(); - queryParams.put("id", id); - - // Mock the ResultSet behavior - ResultSet mockResultSet = mock(ResultSet.class); - when(mockResultSet.next()).thenReturn(true); - - // Mock the query method of JdbcTemplate - when(jdbcTemplate.query((PreparedStatementCreator) any(), any(), any(ResultSetExtractor.class))) - .thenAnswer( - invocation -> { - ResultSetExtractor> rse = invocation.getArgument(2); - return rse.extractData(mockResultSet); - }); - - // Act - ResponseEntity response = - blindSQLInjectionVulnerability.getCarInformationLevel3(queryParams); - - // Assert - assertEquals(HttpStatus.OK, response.getStatusCode()); - assertEquals("{ \"isCarPresent\": true}", response.getBody()); - } - - @Test - public void testGetCarInformationLevel3_CarNotPresent() throws SQLException { - // Arrange - String id = "2"; - Map queryParams = new HashMap<>(); - queryParams.put("id", id); - - // Mock the ResultSet behavior - ResultSet mockResultSet = mock(ResultSet.class); - when(mockResultSet.next()).thenReturn(false); - - // Mock the query method of JdbcTemplate - when(jdbcTemplate.query((PreparedStatementCreator) any(), any(), any(ResultSetExtractor.class))) - .thenAnswer( - invocation -> { - ResultSetExtractor> rse = invocation.getArgument(2); - return rse.extractData(mockResultSet); - }); - - // Act - ResponseEntity response = - blindSQLInjectionVulnerability.getCarInformationLevel3(queryParams); - - // Assert - assertEquals(HttpStatus.OK, response.getStatusCode()); - assertEquals( - ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE, response.getBody()); - } + @Mock private JdbcTemplate jdbcTemplate; + + @InjectMocks private BlindSQLInjectionVulnerability blindSQLInjectionVulnerability; + + @BeforeEach + public void setUp() { + MockitoAnnotations.openMocks(this); + } + + @Test + public void testGetCarInformationLevel1_CarPresent() throws SQLException { + // Arrange + String id = "1"; + Map queryParams = new HashMap<>(); + queryParams.put("id", id); + + // The query is simulated to have returned a result (i.e. there is a car with ID "1") + ResultSet mockResultSet = mock(ResultSet.class); + when(mockResultSet.next()).thenReturn(true); + + // return rse.extractData(mockResultSet); indicates that the ResultSetExtractor extracts the + // data from the mockResultSet (which mocks the query result) + when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))) + .thenAnswer( + invocation -> { + ResultSetExtractor> rse = + invocation.getArgument(1); + return rse.extractData(mockResultSet); + }); + + // Act + ResponseEntity response = + blindSQLInjectionVulnerability.getCarInformationLevel1(queryParams); + + // Assert + assertEquals(HttpStatus.OK, response.getStatusCode()); + assertEquals("{ \"isCarPresent\": true}", response.getBody()); + } + + @Test + public void testGetCarInformationLevel1_CarNotPresent() throws SQLException { + // Arrange + String id = "2"; + Map queryParams = new HashMap<>(); + queryParams.put("id", id); + + // The query is simulated to have returned a result (i.e. there is no a car with ID "2") + ResultSet mockResultSet = mock(ResultSet.class); + when(mockResultSet.next()).thenReturn(false); + + // return rse.extractData(mockResultSet); indicates that the ResultSetExtractor extracts the + // data from the mockResultSet (which mocks the query result) + when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))) + .thenAnswer( + invocation -> { + ResultSetExtractor> rse = + invocation.getArgument(1); + return rse.extractData(mockResultSet); + }); + + // Act + ResponseEntity response = + blindSQLInjectionVulnerability.getCarInformationLevel1(queryParams); + + // Assert + assertEquals(HttpStatus.OK, response.getStatusCode()); + assertEquals( + ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE, + response.getBody()); + } + + @Test + public void testGetCarInformationLevel2_CarPresent() throws SQLException { + // Arrange + String id = "1"; + Map queryParams = new HashMap<>(); + queryParams.put("id", id); + + // Mock the ResultSet behavior + ResultSet mockResultSet = mock(ResultSet.class); + when(mockResultSet.next()).thenReturn(true); + + // Mock the query method of JdbcTemplate + when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))) + .thenAnswer( + invocation -> { + ResultSetExtractor> rse = + invocation.getArgument(1); + return rse.extractData(mockResultSet); + }); + + // Act + ResponseEntity response = + blindSQLInjectionVulnerability.getCarInformationLevel2(queryParams); + + // Assert + assertEquals(HttpStatus.OK, response.getStatusCode()); + assertEquals("{ \"isCarPresent\": true}", response.getBody()); + } + + @Test + public void testGetCarInformationLevel2_CarNotPresent() throws SQLException { + // Arrange + String id = "2"; + Map queryParams = new HashMap<>(); + queryParams.put("id", id); + + // Mock the ResultSet behavior + ResultSet mockResultSet = mock(ResultSet.class); + when(mockResultSet.next()).thenReturn(false); + + // Mock the query method of JdbcTemplate + when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))) + .thenAnswer( + invocation -> { + ResultSetExtractor> rse = + invocation.getArgument(1); + return rse.extractData(mockResultSet); + }); + + // Act + ResponseEntity response = + blindSQLInjectionVulnerability.getCarInformationLevel2(queryParams); + + // Assert + assertEquals(HttpStatus.OK, response.getStatusCode()); + assertEquals( + ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE, + response.getBody()); + } + + @Test + public void testGetCarInformationLevel3_CarPresent() throws SQLException { + // Arrange + String id = "1"; + Map queryParams = new HashMap<>(); + queryParams.put("id", id); + + // Mock the ResultSet behavior + ResultSet mockResultSet = mock(ResultSet.class); + when(mockResultSet.next()).thenReturn(true); + + // Mock the query method of JdbcTemplate + when(jdbcTemplate.query( + (PreparedStatementCreator) any(), any(), any(ResultSetExtractor.class))) + .thenAnswer( + invocation -> { + ResultSetExtractor> rse = + invocation.getArgument(2); + return rse.extractData(mockResultSet); + }); + + // Act + ResponseEntity response = + blindSQLInjectionVulnerability.getCarInformationLevel3(queryParams); + + // Assert + assertEquals(HttpStatus.OK, response.getStatusCode()); + assertEquals("{ \"isCarPresent\": true}", response.getBody()); + } + + @Test + public void testGetCarInformationLevel3_CarNotPresent() throws SQLException { + // Arrange + String id = "2"; + Map queryParams = new HashMap<>(); + queryParams.put("id", id); + + // Mock the ResultSet behavior + ResultSet mockResultSet = mock(ResultSet.class); + when(mockResultSet.next()).thenReturn(false); + + // Mock the query method of JdbcTemplate + when(jdbcTemplate.query( + (PreparedStatementCreator) any(), any(), any(ResultSetExtractor.class))) + .thenAnswer( + invocation -> { + ResultSetExtractor> rse = + invocation.getArgument(2); + return rse.extractData(mockResultSet); + }); + + // Act + ResponseEntity response = + blindSQLInjectionVulnerability.getCarInformationLevel3(queryParams); + + // Assert + assertEquals(HttpStatus.OK, response.getStatusCode()); + assertEquals( + ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE, + response.getBody()); + } } -