sql_injection_test.cpp File Reference

#include <gtest/gtest.h>
#include <memory>
#include <string>
#include <vector>
#include "database/query_builder.h"
#include "database/backends/sqlite_backend.h"
#include "database/core/database_backend.h"

Include dependency graph for sql_injection_test.cpp:

Go to the source code of this file.

Classes
class	SQLInjectionTest
	Test fixture for SQL injection prevention tests. More...

Functions
	TEST_F (SQLInjectionTest, BasicInjectionAttempt)
	Tests that basic OR injection is properly escaped.
	TEST_F (SQLInjectionTest, CommentInjectionAttempt)
	Tests that comment-based injection is handled.
	TEST_F (SQLInjectionTest, BatchStatementInjectionAttempt)
	Tests that batch statement injection is prevented.
	TEST_F (SQLInjectionTest, UnionInjectionAttempt)
	Tests that UNION-based injection is prevented.
	TEST_F (SQLInjectionTest, ApostropheInValueSafe)
	Tests that apostrophes in values are properly handled.
	TEST_F (SQLInjectionTest, SpecialCharactersInValue)
	Tests handling of various special characters.
	TEST_F (SQLInjectionTest, NumericValueInjection)
	Tests that numeric value fields handle string injection.
	TEST_F (SQLInjectionTest, BooleanValueHandling)
	Tests that boolean values are handled safely.
	TEST_F (SQLInjectionTest, PreparedSelectReturnsCorrectResults)
	Tests that prepared SELECT queries bind parameters correctly.
	TEST_F (SQLInjectionTest, PreparedSelectBlocksInjection)
	Tests that prepared statements prevent SQL injection at wire level.
	TEST_F (SQLInjectionTest, PreparedExecuteWithTypedParams)
	Tests that execute_prepared handles typed parameters.
	TEST_F (SQLInjectionTest, PreparedBatchStatementInjectionBlocked)
	Tests that prepared statements block batch statement injection.
	TEST_F (SQLInjectionTest, PreparedNullParameterHandling)
	Tests that NULL parameters bind correctly in prepared statements.
	TEST_F (SQLInjectionTest, ResetPreventsDataLeakage)
	Tests that reset() properly clears all builder state.
	TEST_F (SQLInjectionTest, UnicodeBypassAttempt)
	Tests handling of Unicode characters that might bypass filters.

Function Documentation

TEST_F() [1/15]

TEST_F	(	SQLInjectionTest	,
		ApostropheInValueSafe	)

Tests that apostrophes in values are properly handled.

Test

ApostropheInValueSafe

Input: O'Brien (legitimate name) Expected: Query executes safely with escaped apostrophe

Definition at line 227 of file sql_injection_test.cpp.

                                                {
#ifdef USE_SQLITE
    // Insert a user with apostrophe in name
    auto insert_result = db_->execute_query(
        "INSERT INTO users (id, name, email, password_hash) "
        "VALUES (3, 'O''Brien', 'obrien@test.com', 'hash789')"
    );
    (void)insert_result;
 
    core::database_value safe_value = std::string("O'Brien");
 
    query_builder builder(database_types::sqlite);
    auto query = builder
        .select({"*"})
        .from("users")
        .where("name", "=", safe_value)
        .build();
 
    // Check that apostrophe is escaped in built query
    // Should contain either O''Brien (SQL standard) or O\'Brien (backslash-escaped)
    bool properly_escaped =
        (query.find("O''Brien") != std::string::npos) ||
        (query.find("O\\'Brien") != std::string::npos) ||
        (query.find("O'Brien") != std::string::npos);  // May work if using prepared stmt
 
    EXPECT_TRUE(properly_escaped)
        << "Query should handle apostrophe safely. Built query: " << query;
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}

References database::query_builder::build(), database::query_builder::select(), and database::query_builder::where().

Here is the call graph for this function:

TEST_F() [2/15]

TEST_F	(	SQLInjectionTest	,
		BasicInjectionAttempt	)

Tests that basic OR injection is properly escaped.

Test

BasicInjectionAttempt

Attack: ' OR '1'='1 Expected: Query treats input as literal string, returns 0 rows

Definition at line 81 of file sql_injection_test.cpp.

                                                {
#ifdef USE_SQLITE
    std::string malicious_input = "' OR '1'='1";
 
    query_builder builder(database_types::sqlite);
    auto query = builder
        .select({"*"})
        .from("users")
        .where("name", "=", malicious_input)
        .build();
 
    auto query_result = db_->select_query(query);
 
    // If properly escaped, should return 0 rows (no user named "' OR '1'='1")
    // If vulnerable, would return all rows
    if (query_result.is_ok()) {
        EXPECT_LE(query_result.value().size(), 1u)
            << "Possible SQL injection vulnerability: query returned multiple rows";
    }
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}

References database::query_builder::build(), database::query_builder::select(), and database::query_builder::where().

Here is the call graph for this function:

TEST_F() [3/15]

TEST_F	(	SQLInjectionTest	,
		BatchStatementInjectionAttempt	)

Tests that batch statement injection is prevented.

Test

BatchStatementInjectionAttempt

Attack: '; DROP TABLE users; – Expected: Table should still exist after query

Definition at line 141 of file sql_injection_test.cpp.

                                                         {
#ifdef USE_SQLITE
    std::string malicious_input = "'; DROP TABLE users; --";
 
    query_builder builder(database_types::sqlite);
    auto query = builder
        .select({"*"})
        .from("users")
        .where("name", "=", malicious_input)
        .build();
 
    // Execute the query (may fail, but shouldn't drop table)
    db_->select_query(query);
 
    // Verify table still exists by querying it
    auto check = db_->select_query("SELECT COUNT(*) as cnt FROM users");
    EXPECT_TRUE(check.is_ok() && !check.value().empty())
        << "CRITICAL: Table appears to have been dropped!";
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}

References database::query_builder::build(), database::query_builder::select(), and database::query_builder::where().

Here is the call graph for this function:

TEST_F() [4/15]

TEST_F	(	SQLInjectionTest	,
		BooleanValueHandling	)

Tests that boolean values are handled safely.

Test

BooleanValueHandling

Definition at line 330 of file sql_injection_test.cpp.

                                               {
#ifdef USE_SQLITE
    core::database_value bool_value = true;
 
    query_builder builder(database_types::sqlite);
    auto query = builder
        .select({"*"})
        .from("users")
        .where("id", ">", bool_value)
        .build();
 
    // Should render as TRUE or 1, not as quoted string
    EXPECT_TRUE(query.find("TRUE") != std::string::npos ||
                query.find("1") != std::string::npos)
        << "Boolean value handling issue. Query: " << query;
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}

References database::query_builder::build(), database::query_builder::select(), and database::query_builder::where().

Here is the call graph for this function:

TEST_F() [5/15]

TEST_F	(	SQLInjectionTest	,
		CommentInjectionAttempt	)

Tests that comment-based injection is handled.

Test

CommentInjectionAttempt

Attack: admin'– Expected: Query treats input as literal string

Definition at line 112 of file sql_injection_test.cpp.

                                                  {
#ifdef USE_SQLITE
    std::string malicious_input = "admin'--";
 
    query_builder builder(database_types::sqlite);
    auto query = builder
        .select({"*"})
        .from("users")
        .where("name", "=", malicious_input)
        .build();
 
    auto query_result = db_->select_query(query);
 
    // Should return 0 rows - no user named "admin'--"
    if (query_result.is_ok()) {
        EXPECT_EQ(query_result.value().size(), 0u);
    }
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}

References database::query_builder::build(), database::query_builder::select(), and database::query_builder::where().

Here is the call graph for this function:

TEST_F() [6/15]

TEST_F	(	SQLInjectionTest	,
		NumericValueInjection	)

Tests that numeric value fields handle string injection.

Test

NumericValueInjection

Definition at line 305 of file sql_injection_test.cpp.

                                                {
#ifdef USE_SQLITE
    // Attempting to inject via what should be a numeric field
    core::database_value numeric_value = static_cast<int64_t>(1);
 
    query_builder builder(database_types::sqlite);
    auto query = builder
        .select({"*"})
        .from("users")
        .where("id", "=", numeric_value)
        .build();
 
    // Numeric values should be rendered without quotes
    EXPECT_TRUE(query.find("id = 1") != std::string::npos ||
                query.find("[id] = 1") != std::string::npos)
        << "Numeric value should not be quoted. Query: " << query;
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}

References database::query_builder::build(), database::query_builder::select(), and database::query_builder::where().

Here is the call graph for this function:

TEST_F() [7/15]

TEST_F	(	SQLInjectionTest	,
		PreparedBatchStatementInjectionBlocked	)

Tests that prepared statements block batch statement injection.

Test

PreparedBatchStatementInjectionBlocked

Definition at line 428 of file sql_injection_test.cpp.

                                                                 {
#ifdef USE_SQLITE
    std::string malicious = "'; DROP TABLE users; --";
    std::vector<core::database_value> params = {malicious};
    db_->select_prepared("SELECT * FROM users WHERE name = ?", params);
 
    // Verify the table still exists
    auto check = db_->select_query("SELECT COUNT(*) as cnt FROM users");
    ASSERT_TRUE(check.is_ok());
    EXPECT_FALSE(check.value().empty())
        << "CRITICAL: Table dropped via prepared statement injection!";
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}

References ASSERT_TRUE.

TEST_F() [8/15]

TEST_F	(	SQLInjectionTest	,
		PreparedExecuteWithTypedParams	)

Tests that execute_prepared handles typed parameters.

Test

PreparedExecuteWithTypedParams

Definition at line 399 of file sql_injection_test.cpp.

                                                         {
#ifdef USE_SQLITE
    std::vector<core::database_value> params = {
        int64_t(10),
        std::string("Charlie"),
        std::string("charlie@test.com"),
        std::string("hash_prep")
    };
    auto exec_result = db_->execute_prepared(
        "INSERT INTO users (id, name, email, password_hash) VALUES (?, ?, ?, ?)",
        params);
    ASSERT_TRUE(exec_result.is_ok());
 
    // Verify the row was inserted
    std::vector<core::database_value> select_params = {int64_t(10)};
    auto select_result = db_->select_prepared(
        "SELECT name FROM users WHERE id = ?", select_params);
    ASSERT_TRUE(select_result.is_ok());
    ASSERT_EQ(select_result.value().size(), 1u);
    EXPECT_EQ(std::get<std::string>(select_result.value()[0].at("name")), "Charlie");
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}

References ASSERT_EQ, and ASSERT_TRUE.

TEST_F() [9/15]

TEST_F	(	SQLInjectionTest	,
		PreparedNullParameterHandling	)

Tests that NULL parameters bind correctly in prepared statements.

Test

PreparedNullParameterHandling

Definition at line 448 of file sql_injection_test.cpp.

                                                        {
#ifdef USE_SQLITE
    std::vector<core::database_value> params = {nullptr};
    auto result = db_->select_prepared(
        "SELECT * FROM users WHERE name = ?", params);
 
    ASSERT_TRUE(result.is_ok());
    EXPECT_EQ(result.value().size(), 0u)
        << "NULL comparison should match no rows (NULL != NULL in SQL)";
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}

References ASSERT_TRUE.

TEST_F() [10/15]

TEST_F	(	SQLInjectionTest	,
		PreparedSelectBlocksInjection	)

Tests that prepared statements prevent SQL injection at wire level.

Test

PreparedSelectBlocksInjection

Definition at line 380 of file sql_injection_test.cpp.

                                                        {
#ifdef USE_SQLITE
    std::string malicious = "' OR '1'='1";
    std::vector<core::database_value> params = {malicious};
    auto result = db_->select_prepared(
        "SELECT * FROM users WHERE name = ?", params);
 
    ASSERT_TRUE(result.is_ok());
    EXPECT_EQ(result.value().size(), 0u)
        << "Prepared statement should treat malicious input as literal string";
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}

References ASSERT_TRUE.

TEST_F() [11/15]

TEST_F	(	SQLInjectionTest	,
		PreparedSelectReturnsCorrectResults	)

Tests that prepared SELECT queries bind parameters correctly.

Test

PreparedSelectReturnsCorrectResults

Definition at line 358 of file sql_injection_test.cpp.

                                                              {
#ifdef USE_SQLITE
    std::vector<core::database_value> params = {std::string("Alice")};
    auto result = db_->select_prepared(
        "SELECT * FROM users WHERE name = ?", params);
 
    ASSERT_TRUE(result.is_ok());
    ASSERT_EQ(result.value().size(), 1u);
 
    const auto& row = result.value()[0];
    auto it = row.find("email");
    ASSERT_NE(it, row.end());
    EXPECT_EQ(std::get<std::string>(it->second), "alice@test.com");
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}

References ASSERT_EQ, and ASSERT_TRUE.

TEST_F() [12/15]

TEST_F	(	SQLInjectionTest	,
		ResetPreventsDataLeakage	)

Tests that reset() properly clears all builder state.

Test

ResetPreventsDataLeakage

Definition at line 470 of file sql_injection_test.cpp.

                                                   {
    query_builder builder(database_types::sqlite);
 
    // Build first query with sensitive filter
    builder
        .select({"*"})
        .from("users")
        .where("email", "=", std::string("admin@secret.com"));
 
    // Reset and build new query
    builder.reset();
    auto query = builder
        .select({"id"})
        .from("public_data")
        .build();
 
    // Previous filter should not leak into new query
    EXPECT_TRUE(query.find("admin@secret") == std::string::npos)
        << "Previous query data leaked after reset! Query: " << query;
    EXPECT_TRUE(query.find("users") == std::string::npos)
        << "Previous table leaked after reset! Query: " << query;
}

References database::query_builder::build(), database::query_builder::reset(), database::query_builder::select(), and database::query_builder::where().

Here is the call graph for this function:

TEST_F() [13/15]

TEST_F	(	SQLInjectionTest	,
		SpecialCharactersInValue	)

Tests handling of various special characters.

Test

SpecialCharactersInValue

Definition at line 263 of file sql_injection_test.cpp.

                                                   {
#ifdef USE_SQLITE
    std::vector<std::string> special_inputs = {
        "test\\value",     // Backslash
        "test\"value",     // Double quote
        "test\nvalue",     // Newline
        "test\rvalue",     // Carriage return
        "test\tvalue",     // Tab
        "test%value",      // Percent (LIKE wildcard)
        "test_value",      // Underscore (LIKE wildcard)
    };
 
    for (const auto& input : special_inputs) {
        query_builder builder(database_types::sqlite);
        auto query = builder
            .select({"*"})
            .from("users")
            .where("name", "=", input)
            .build();
 
        // Query should build without throwing
        EXPECT_FALSE(query.empty())
            << "Failed to build query with special input: " << input;
 
        // Query execution should not throw
        EXPECT_NO_THROW({
            db_->select_query(query);
        }) << "Query execution failed with special input: " << input;
    }
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}

References database::query_builder::build(), database::query_builder::select(), and database::query_builder::where().

Here is the call graph for this function:

TEST_F() [14/15]

TEST_F	(	SQLInjectionTest	,
		UnicodeBypassAttempt	)

Tests handling of Unicode characters that might bypass filters.

Test

UnicodeBypassAttempt

Definition at line 501 of file sql_injection_test.cpp.

                                               {
#ifdef USE_SQLITE
    // Various Unicode representations that might bypass naive filters
    std::vector<std::string> unicode_attacks = {
        "\xc0\x27",          // Overlong encoding of '
        "\xe0\x80\xa7",      // Another overlong encoding
        "admin\xef\xbb\xbf", // With BOM
    };
 
    for (const auto& attack : unicode_attacks) {
        query_builder builder(database_types::sqlite);
        auto query = builder
            .select({"*"})
            .from("users")
            .where("name", "=", attack)
            .build();
 
        // Should handle without crashing
        EXPECT_NO_THROW({
            db_->select_query(query);
        }) << "Query failed with unicode attack: [binary data]";
    }
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}

References database::query_builder::build(), database::query_builder::select(), and database::query_builder::where().

Here is the call graph for this function:

TEST_F() [15/15]

TEST_F	(	SQLInjectionTest	,
		UnionInjectionAttempt	)

Tests that UNION-based injection is prevented.

Test

UnionInjectionAttempt

Attack: ' UNION SELECT * FROM sensitive_data – Expected: Query should not execute UNION

Definition at line 175 of file sql_injection_test.cpp.

                                                {
#ifdef USE_SQLITE
    // Create a sensitive table for the test
    db_->execute_query(
        "CREATE TABLE sensitive_data (secret TEXT)"
    );
    db_->execute_query(
        "INSERT INTO sensitive_data VALUES ('top_secret_value')"
    );
 
    std::string malicious_input = "' UNION SELECT secret, secret, secret, secret FROM sensitive_data --";
 
    query_builder builder(database_types::sqlite);
    auto query = builder
        .select({"*"})
        .from("users")
        .where("name", "=", malicious_input)
        .build();
 
    auto query_result = db_->select_query(query);
 
    // Check that sensitive data was not leaked
    bool found_secret = false;
    if (query_result.is_ok()) {
        for (const auto& row : query_result.value()) {
            for (const auto& [key, value] : row) {
                if (std::holds_alternative<std::string>(value)) {
                    if (std::get<std::string>(value).find("top_secret") != std::string::npos) {
                        found_secret = true;
                    }
                }
            }
        }
    }
    EXPECT_FALSE(found_secret)
        << "CRITICAL: Sensitive data leaked through UNION injection!";
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}

References database::query_builder::build(), database::query_builder::select(), and database::query_builder::where().

Here is the call graph for this function: