Add more test cases

AikidoSec · Mar 7, 2024 · 1de02e2 · 1de02e2
1 parent 651610a
commit 1de02e2
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 9 deletions.
diff --git a/library/src/vulnerabilities/sql-injection/dialect/SQLDialectPostgres.test.ts b/library/src/vulnerabilities/sql-injection/dialect/SQLDialectPostgres.test.ts
@@ -148,17 +148,17 @@ END;
 $function$;`,
       [[11, 58, "\nBEGIN\n  RETURN ($1 ~ $q$[\\t\\r\\n\\v\\\\]$q$);\nEND;\n"]],
     ],
-    /*[
+    [
       `SELECT * FROM functions WHERE definition = $$BEGIN RETURN $Q$SELECT 'Hello, World!';$Q$; END;$$;`,
-      [[45, 93, "BEGIN RETURN $Q$SELECT 'Hello, World!';$Q$; END;"]],
+      [[45, 92, "BEGIN RETURN $Q$SELECT 'Hello, World!';$Q$; END;"]],
     ],
     [
       `SELECT * FROM scripts WHERE content = $CustomTag$Incorrectly terminated string;`,
       [],
     ],
     [
       `SELECT * FROM articles WHERE body = $$He said, 'This is "quoted" text.'$$;`,
-      [[38, 71, "He said, 'This is \"quoted\" text.'"]],
+      [[38, 70, "He said, 'This is \"quoted\" text.'"]],
     ],
     [
       `SELECT * FROM articles WHERE body = $He said, 'This is "quoted" text.'$$;`,
@@ -170,24 +170,24 @@ $function$;`,
     ],
     [
       `SELECT * FROM articles WHERE body = $Tag$He said, 'This is "quoted" text.'$Tag$;`,
-      [[41, 74, "He said, 'This is \"quoted\" text.'"]],
+      [[41, 73, "He said, 'This is \"quoted\" text.'"]],
     ],
     [
       `SELECT * FROM articles WHERE body = $Tag$He said, 'This is "quoted" text.'$tag$;`,
       [],
     ],
     [
-      `SELECT * FROM books /!* Outer comment /!* Nested comment *!/ Outer continued *!/;`,
+      `SELECT * FROM books /* Outer comment /!* Nested comment *!/ Outer continued */;`,
       [],
     ],
     [
       `SELECT * FROM comments WHERE text = 'This -- is not a comment.';`,
-      [[37, 62, "This -- is not a comment."]],
+      [[37, 61, "This -- is not a comment."]],
     ],
     [
       `SELECT * FROM pages WHERE content = $A$This is a \'quoted\' text inside a dollar-quoted string$A$;`,
-      [[39, 92, "This is a 'quoted' text inside a dollar-quoted string"]],
-    ],*/
+      [[39, 91, "This is a 'quoted' text inside a dollar-quoted string"]],
+    ],
     [
       `
         SELECT * FROM MY_TABLE;

diff --git a/library/src/vulnerabilities/sql-injection/dialect/SQLDialectPostgres.ts b/library/src/vulnerabilities/sql-injection/dialect/SQLDialectPostgres.ts
@@ -115,7 +115,7 @@ export class SQLDialectPostgres implements SQLDialect {
         }
 
         if (!literal) {
-          const name = /^([A-Za-z0-9_]+)/;
+          const name = /^([A-Za-z0-9_]+)\$/;
           const match = sql.slice(i + 1).match(name);
           if (match) {
             literal = { start: i, tag: true, name: match[1] };