28 lines
1.3 KiB
JavaScript
28 lines
1.3 KiB
JavaScript
'use strict';
|
|
|
|
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const { assertReadOnlySql, maskSql } = require('../../src/security/read-only-sql');
|
|
|
|
test('read-only SQL policy accepts inspection queries and harmless literals', () => {
|
|
assert.equal(assertReadOnlySql('SELECT title FROM games LIMIT 10'), 'SELECT title FROM games LIMIT 10');
|
|
assert.equal(assertReadOnlySql("SELECT 'delete from games' AS example"), "SELECT 'delete from games' AS example");
|
|
assert.equal(assertReadOnlySql('WITH ids AS (SELECT id FROM games) SELECT * FROM ids'), 'WITH ids AS (SELECT id FROM games) SELECT * FROM ids');
|
|
assert.equal(assertReadOnlySql('PRAGMA table_info(games)'), 'PRAGMA table_info(games)');
|
|
assert.match(maskSql("SELECT 'quoted' -- comment\nFROM games"), /^SELECT\s+\s+\s+FROM games$/m);
|
|
});
|
|
|
|
test('read-only SQL policy blocks writable PRAGMAs, DML, stacked statements and extensions', () => {
|
|
const blocked = [
|
|
'PRAGMA user_version = 123',
|
|
'PRAGMA user_version(123)',
|
|
'PRAGMA journal_mode=WAL',
|
|
'PRAGMA optimize',
|
|
'WITH ids AS (SELECT id FROM games) DELETE FROM games',
|
|
'SELECT 1; DROP TABLE games',
|
|
"SELECT load_extension('payload')",
|
|
"SELECT writefile('/tmp/out', 'content')",
|
|
];
|
|
for (const sql of blocked) assert.throws(() => assertReadOnlySql(sql), undefined, sql);
|
|
});
|