92255a46ed
- Shared pgx/GORM pool, ICU locale fail, and isolated plugin migrations - Seven-stage middleware order, missing-guard boot failure, typed 404s - Adversarial JWT matrix including alg:none, empty secret, and no leak Co-authored-by: Cursor <cursoragent@cursor.com>
43 lines
1.1 KiB
Go
43 lines
1.1 KiB
Go
package lagoon
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestOrderClauseAllowList(t *testing.T) {
|
|
allowed := []string{"golem15_fonoteka_genres.name", "items.title"}
|
|
|
|
got, err := orderClause("golem15_fonoteka_genres.name", "asc", allowed)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got != "golem15_fonoteka_genres.name ASC" {
|
|
t.Fatalf("got %q", got)
|
|
}
|
|
if strings.Contains(strings.ToLower(got), "collate") {
|
|
t.Fatalf("must not emit COLLATE: %q", got)
|
|
}
|
|
|
|
got, err = orderClause("items.title", "DESC", allowed)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got != "items.title DESC" {
|
|
t.Fatalf("got %q", got)
|
|
}
|
|
|
|
if _, err := orderClause("golem15_fonoteka_genres.name;drop table x", "asc", allowed); err == nil {
|
|
t.Fatal("want reject unknown column")
|
|
}
|
|
if _, err := orderClause("golem15_fonoteka_genres.name", "ascending", allowed); err == nil {
|
|
t.Fatal("want reject unknown direction")
|
|
}
|
|
if _, err := OrderBy(nil, "items.title", "asc", allowed); err == nil {
|
|
t.Fatal("want nil db error")
|
|
}
|
|
if _, err := orderClause("items.title", "asc", nil); err == nil {
|
|
t.Fatal("empty allow-list must reject")
|
|
}
|
|
}
|