vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: added a case with backticks

Browse source
This commit is contained in:
Daizy Modi 2022-12-14 17:01:19 +05:30
parent 3e824a9ea5
commit 9a8dbc42a7
1 changed files with 7 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
frappe/tests/test_search.py
View file

@ -186,28 +186,13 @@ class TestSearch(FrappeTestCase):
self.assertListEqual(frappe.response["results"], [])
def test_sanitize_searchfield(self):
# should raise error if searchfield is injectable
self.assertRaisesRegex(
frappe.DataError,
re.compile(r"^(Invalid Search Field .*)$"),
sanitize_searchfield,
"1=1",
)
# should raise error if searchfield is special character
self.assertRaisesRegex(
frappe.DataError,
re.compile(r"^(Invalid Search Field .*)$"),
sanitize_searchfield,
";",
)
self.assertRaisesRegex(
frappe.DataError,
re.compile(r"^(Invalid Search Field .*)$"),
sanitize_searchfield,
"name or (select * from tabSessions)",
)
for searchfield in ("1=1", "name or (select * from tabSessions)", ";", "`tabSessions`"):
self.assertRaisesRegex(
frappe.DataError,
re.compile(r"^(Invalid Search Field .*)$"),
sanitize_searchfield,
searchfield,
)
sanitize_searchfield("name")