Merge branch 'mhujer-fix-db-tests'

zendframework · Jun 16, 2014 · 3f5a21e · 3f5a21e
2 parents 129f65c + 005bd71
commit 3f5a21e
Show file tree

Hide file tree

Showing 7 changed files with 68 additions and 2 deletions.
diff --git a/tests/Zend/Db/Select/Pdo/PgsqlTest.php b/tests/Zend/Db/Select/Pdo/PgsqlTest.php
@@ -126,4 +126,15 @@ public function testSelectFromSchemaInNameOverridesSchemaArgument()
 
         $this->assertEquals(4, count($rowset));
     }
+
+    public function testSqlInjectionWithOrder()
+    {
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('MD5(1);select');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);select" ASC', $select->assemble());
+
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('name;select;MD5(1)');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "name;select;MD5(1)" ASC', $select->assemble());
+    }
 }
diff --git a/tests/Zend/Db/Select/Pdo/SqliteTest.php b/tests/Zend/Db/Select/Pdo/SqliteTest.php
@@ -174,4 +174,15 @@ public function getDriver()
         return 'Pdo_Sqlite';
     }
 
+    public function testSqlInjectionWithOrder()
+    {
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('MD5(1);select');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);select" ASC', $select->assemble());
+
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('name;select;MD5(1)');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "name;select;MD5(1)" ASC', $select->assemble());
+    }
+
 }
diff --git a/tests/Zend/Db/Select/StaticTest.php b/tests/Zend/Db/Select/StaticTest.php
@@ -820,4 +820,15 @@ public function getDriver()
     {
         return 'Static';
     }
+
+    public function testSqlInjectionWithOrder()
+    {
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('MD5(1);select');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);select" ASC', $select->assemble());
+
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('name;select;MD5(1)');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "name;select;MD5(1)" ASC', $select->assemble());
+    }
 }
diff --git a/tests/Zend/Db/Select/TestCommon.php b/tests/Zend/Db/Select/TestCommon.php
@@ -1761,10 +1761,10 @@ public function testSqlInjectionWithOrder()
     {
         $select = $this->_db->select();
         $select->from(array('p' => 'products'))->order('MD5(1);select');
-        $this->assertEquals($select, 'SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);select" ASC');
+        $this->assertEquals('SELECT `p`.* FROM `products` AS `p` ORDER BY `MD5(1);select` ASC', $select->assemble());
 
         $select = $this->_db->select();
         $select->from(array('p' => 'products'))->order('name;select;MD5(1)');
-        $this->assertEquals($select, 'SELECT "p".* FROM "products" AS "p" ORDER BY "name;select;MD5(1)" ASC');
+        $this->assertEquals('SELECT `p`.* FROM `products` AS `p` ORDER BY `name;select;MD5(1)` ASC', $select->assemble());
     }
 }
diff --git a/tests/Zend/Db/Table/Select/Pdo/PgsqlTest.php b/tests/Zend/Db/Table/Select/Pdo/PgsqlTest.php
@@ -130,4 +130,15 @@ protected function _selectColumnWithColonQuotedParameter ()
                             ->where($product_name . ' = ?', "as'as:x");
         return $select;
     }
+
+    public function testSqlInjectionWithOrder()
+    {
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('MD5(1);select');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);select" ASC', $select->assemble());
+
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('name;select;MD5(1)');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "name;select;MD5(1)" ASC', $select->assemble());
+    }
  }
diff --git a/tests/Zend/Db/Table/Select/Pdo/SqliteTest.php b/tests/Zend/Db/Table/Select/Pdo/SqliteTest.php
@@ -178,4 +178,15 @@ public function getDriver()
         return 'Pdo_Sqlite';
     }
 
+    public function testSqlInjectionWithOrder()
+    {
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('MD5(1);select');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);select" ASC', $select->assemble());
+
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('name;select;MD5(1)');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "name;select;MD5(1)" ASC', $select->assemble());
+    }
+
 }
diff --git a/tests/Zend/Db/Table/Select/StaticTest.php b/tests/Zend/Db/Table/Select/StaticTest.php
@@ -697,4 +697,15 @@ public function getDriver()
         return 'Static';
     }
 
+    public function testSqlInjectionWithOrder()
+    {
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('MD5(1);select');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);select" ASC', $select->assemble());
+
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('name;select;MD5(1)');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "name;select;MD5(1)" ASC', $select->assemble());
+    }
+
 }