diff --git a/frappe/tests/test_search.py b/frappe/tests/test_search.py index 5d98d6f49f..24bd8b8057 100644 --- a/frappe/tests/test_search.py +++ b/frappe/tests/test_search.py @@ -5,12 +5,7 @@ import re import frappe from frappe.app import make_form_dict -from frappe.desk.search import ( - get_names_for_mentions, - sanitize_searchfield, - search_link, - search_widget, -) +from frappe.desk.search import get_names_for_mentions, search_link, search_widget from frappe.tests.utils import FrappeTestCase from frappe.utils import set_request from frappe.website.serve import get_response @@ -32,71 +27,24 @@ class TestSearch(FrappeTestCase): self.assertTrue("User" in result["value"]) # raise exception on injection - self.assertRaises( - frappe.DataError, - search_link, - "DocType", - "Customer", - query=None, - filters=None, - page_length=20, - searchfield="1=1", - ) - - self.assertRaises( - frappe.DataError, - search_link, - "DocType", - "Customer", - query=None, - filters=None, - page_length=20, - searchfield="select * from tabSessions) --", - ) - - self.assertRaises( - frappe.DataError, - search_link, - "DocType", - "Customer", - query=None, - filters=None, - page_length=20, - searchfield="name or (select * from tabSessions)", - ) - - self.assertRaises( - frappe.DataError, - search_link, - "DocType", - "Customer", - query=None, - filters=None, - page_length=20, - searchfield="*", - ) - - self.assertRaises( - frappe.DataError, - search_link, - "DocType", - "Customer", - query=None, - filters=None, - page_length=20, - searchfield=";", - ) - - self.assertRaises( - frappe.DataError, - search_link, - "DocType", - "Customer", - query=None, - filters=None, - page_length=20, - searchfield=";", - ) + for searchfield in ( + "1=1", + "select * from tabSessions) --", + "name or (select * from tabSessions)", + "*", + ";", + "select`sid`from`tabSessions`", + ): + self.assertRaises( + frappe.DataError, + search_link, + "DocType", + "User", + query=None, + filters=None, + page_length=20, + searchfield=searchfield, + ) def test_only_enabled_in_mention(self): email = "test_disabled_user_in_mentions@example.com" @@ -185,17 +133,6 @@ class TestSearch(FrappeTestCase): search_link("User", "user@random", searchfield="name") self.assertListEqual(frappe.response["results"], []) - def test_sanitize_searchfield(self): - for searchfield in ("1=1", "name or (select * from tabSessions)", ";", "`tabSessions`"): - self.assertRaisesRegex( - frappe.DataError, - re.compile(r"^(Invalid Search Field .*)$"), - sanitize_searchfield, - searchfield, - ) - - sanitize_searchfield("name") - @frappe.validate_and_sanitize_search_inputs def get_data(doctype, txt, searchfield, start, page_len, filters):