Fixing testcases and level5

SasanLabs · Dec 18, 2023 · d5ea693 · d5ea693
1 parent 713a0f3
commit d5ea693
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 3 deletions.
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/CarInformation.java b/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/CarInformation.java
@@ -15,7 +15,7 @@ public class CarInformation {
 
     private String name;
 
-    @Column(name = "IMAGE")
+    @Column(name = "image")
     private String imagePath;
 
     public CarInformation() {}
@@ -50,4 +50,8 @@ public String getImagePath() {
     public void setImagePath(String imagePath) {
         this.imagePath = imagePath;
     }
+
+    public void setImage(String imagePath) {
+        this.imagePath = imagePath;
+    }
 }
diff --git a/...org/sasanlabs/service/vulnerability/sqlInjection/UnionBasedSQLInjectionVulnerability.java b/...org/sasanlabs/service/vulnerability/sqlInjection/UnionBasedSQLInjectionVulnerability.java
@@ -18,6 +18,7 @@
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
+import org.springframework.jdbc.core.BeanPropertyRowMapper;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.jdbc.core.namedparam.MapSqlParameterSource;
 import org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate;
@@ -120,7 +121,9 @@ public ResponseEntity<CarInformation> getCarInformationLevel5(
         SqlParameterSource namedParameters = new MapSqlParameterSource().addValue("id", id);
         CarInformation s =
                 namedParameterJdbcTemplate.queryForObject(
-                        "select * from cars where id=:id", namedParameters, CarInformation.class);
+                        "select * from cars where id=:id",
+                        namedParameters,
+                        new BeanPropertyRowMapper<>(CarInformation.class));
         return new ResponseEntity<>(s, HttpStatus.OK);
     }
 

diff --git a/...sasanlabs/service/vulnerability/sqlInjection/UnionBasedSQLInjectionVulnerabilityTest.java b/...sasanlabs/service/vulnerability/sqlInjection/UnionBasedSQLInjectionVulnerabilityTest.java
@@ -12,9 +12,11 @@
 import org.junit.jupiter.api.Test;
 import org.mockito.ArgumentMatcher;
 import org.mockito.Mockito;
+import org.springframework.jdbc.core.BeanPropertyRowMapper;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.jdbc.core.PreparedStatementSetter;
 import org.springframework.jdbc.core.ResultSetExtractor;
+import org.springframework.jdbc.core.RowMapper;
 import org.springframework.jdbc.core.namedparam.MapSqlParameterSource;
 import org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate;
 
@@ -124,6 +126,11 @@ void getCarInformationLevel5_ExpectParamEscaped() {
                 .queryForObject(
                         eq("select * from cars where id=:id"),
                         argThat(argumentMatcher),
-                        eq(CarInformation.class));
+                        (RowMapper<Object>)
+                                argThat(
+                                        val ->
+                                                ((BeanPropertyRowMapper) val)
+                                                        .getMappedClass()
+                                                        .equals(CarInformation.class)));
     }
 }