Rspec的不捕錯誤StatementInvalid

Question

我試圖從SQL注入保護自己，我在#WHERE使用變量作爲列名：

class BuildSegment::FindUsers 

    def initialize(params) 
    @key = User.connection.quote_column_name(params[:key]) 
    @negative = params[:negative] 
    @pattern = params[:pattern] 
    end 

    def call 
    if @negative 
     users = User.where.not("#{@key} LIKE ?", @pattern) 
    else 
     users = User.where("#{@key} LIKE ?", @pattern) 
    end 

    users.uniq 
    end 
end 

可變@key從哈希可以由被操縱採取用戶。因此，舉例來說，如果@key = "email LIKE '%' OR email"，我路過@key直接到活動記錄查詢，我得到：

SELECT "users".* FROM "users" WHERE (email LIKE '%' OR email LIKE '') 

返回的所有用戶。我發現quote_column_name(params[:key])作爲返回ActiveRecord::StatementInvalid錯誤的解決方案：

ActiveRecord::StatementInvalid: 
     PG::UndefinedColumn: ERROR: column "email LIKE '%com%' OR email" does not exist 
     LINE 1: SELECT DISTINCT "users".* FROM "users" WHERE ("email LIKE '%... 
                  ^
     : SELECT DISTINCT "users".* FROM "users" WHERE ("email LIKE '%com%' OR email" LIKE '') 

這個測試，但是，失敗：

expect(segment_builder.call).to raise_error(ActiveRecord::StatementError) 

和全回溯：

Failures: 

    1) BuildSegment is protected from SQL injection 
    Failure/Error: users_to_add = users.flatten 

    ActiveRecord::StatementInvalid: 
     PG::UndefinedColumn: ERROR: column "email LIKE '%com%' OR email" does not exist 
     LINE 1: SELECT DISTINCT "users".* FROM "users" WHERE ("email LIKE '%... 
                  ^
     : SELECT DISTINCT "users".* FROM "users" WHERE ("email LIKE '%com%' OR email" LIKE '') 
    # ./app/services/build_segment.rb:51:in `flatten' 
    # ./app/services/build_segment.rb:51:in `users_passing_all_rules' 
    # ./app/services/build_segment.rb:46:in `users_passing_filter' 
    # ./app/services/build_segment.rb:32:in `block in users_meeting_requirements_for' 
    # ./app/services/build_segment.rb:31:in `each' 
    # ./app/services/build_segment.rb:31:in `users_meeting_requirements_for' 
    # ./app/services/build_segment.rb:8:in `call' 
    # ./spec/services/build_segment_spec.rb:107:in `block (2 levels) in <top (required)>' 
    # ------------------ 
    # --- Caused by: --- 
    # PG::UndefinedColumn: 
    # ERROR: column "email LIKE '%com%' OR email" does not exist 
    # LINE 1: SELECT DISTINCT "users".* FROM "users" WHERE ("email LIKE '%... 
    #              ^
    # ./app/services/build_segment.rb:51:in `flatten' 

哪裏可能是我的錯誤？

Answer 1

兩個問題與您的代碼：

1）錯誤是ActiveRecord::StatementInvalid，不ActiveRecord::StatementError和

2）您需要使用塊的語法expect {}捕捉異常。有關更多詳細信息，請參見https://www.relishapp.com/rspec/rspec-expectations/docs/built-in-matchers/raise-error-matcher。

Answer 2

它看起來像我不喜歡你的SQL正確逃脫。

看看這對你的作品：

User.where.not("#{@key} LIKE ?, '#{@pattern}'") 

User.where("#{@key} LIKE ?, '#{@pattern}'")