Skip to content

Commit

Permalink
Add failing test
Browse files Browse the repository at this point in the history
  • Loading branch information
hansott committed Dec 30, 2024
1 parent 99cc268 commit 2a4dc39
Showing 1 changed file with 42 additions and 0 deletions.
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
--TEST--
Test SQLite database operations

--ENV--
AIKIDO_LOG_LEVEL=INFO
AIKIDO_BLOCK=1

--FILE--
<?php
try {
$pdo = new PDO('sqlite::memory:');
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$pdo->exec("CREATE TABLE IF NOT EXISTS users (
id INTEGER PRIMARY KEY,
name TEXT,
email TEXT)");

$pdo->exec("INSERT INTO users (name, email) VALUES ('John Doe', '[email protected]')");

// Simulate user input
$unsafeInput = "1' OR $$ IS NULL -- ";
$_SERVER['HTTP_USER'] = $unsafeInput;

// Vulnerable query
$result = $pdo->query("SELECT * FROM users WHERE id = $unsafeInput");

foreach ($result as $row) {
echo "ID: " . $row['id'] . "\n";
echo "Name: " . $row['name'] . "\n";
echo "Email: " . $row['email'] . "\n\n";
}
} catch (PDOException $e) {
echo "Connection failed: " . $e->getMessage();
}

// Close the database connection
$pdo = null;

?>

--EXPECTREGEX--
.*Fatal error: Uncaught Exception: Aikido firewall has blocked an SQL injection.*

0 comments on commit 2a4dc39

Please sign in to comment.