diff --git a/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerabilityTest.java index 9163d9d7..b8a0ec80 100644 --- a/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerabilityTest.java +++ b/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerabilityTest.java @@ -1,13 +1,12 @@ package org.sasanlabs.service.vulnerability.sqlInjection; -import static org.mockito.Mockito.*; import static org.junit.jupiter.api.Assertions.*; +import static org.mockito.Mockito.*; import java.sql.ResultSet; import java.sql.SQLException; import java.util.HashMap; import java.util.Map; - import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; import org.mockito.InjectMocks; @@ -21,164 +20,186 @@ public class BlindSQLInjectionVulnerabilityTest { - @Mock - private JdbcTemplate jdbcTemplate; - - @InjectMocks - private BlindSQLInjectionVulnerability blindSQLInjectionVulnerability; - - @BeforeEach - public void setUp() { - MockitoAnnotations.openMocks(this); - } - - @Test - public void testGetCarInformationLevel1_CarPresent() throws SQLException { - // Arrange - String id = "1"; - Map queryParams = new HashMap<>(); - queryParams.put("id", id); - - // The query is simulated to have returned a result (i.e. there is a car with ID "1") - ResultSet mockResultSet = mock(ResultSet.class); - when(mockResultSet.next()).thenReturn(true); - - // return rse.extractData(mockResultSet); indicates that the ResultSetExtractor extracts the data from the mockResultSet (which mocks the query result) - when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))).thenAnswer(invocation -> { - ResultSetExtractor> rse = invocation.getArgument(1); - return rse.extractData(mockResultSet); - }); - - // Act - ResponseEntity response = blindSQLInjectionVulnerability.getCarInformationLevel1(queryParams); - - // Assert - assertEquals(HttpStatus.OK, response.getStatusCode()); - assertEquals("{ \"isCarPresent\": true}", response.getBody()); - } - - @Test - public void testGetCarInformationLevel1_CarNotPresent() throws SQLException { - // Arrange - String id = "2"; - Map queryParams = new HashMap<>(); - queryParams.put("id", id); - - // The query is simulated to have returned a result (i.e. there is no a car with ID "2") - ResultSet mockResultSet = mock(ResultSet.class); - when(mockResultSet.next()).thenReturn(false); - - // return rse.extractData(mockResultSet); indicates that the ResultSetExtractor extracts the data from the mockResultSet (which mocks the query result) - when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))).thenAnswer(invocation -> { - ResultSetExtractor> rse = invocation.getArgument(1); - return rse.extractData(mockResultSet); - }); - - // Act - ResponseEntity response = blindSQLInjectionVulnerability.getCarInformationLevel1(queryParams); - - // Assert - assertEquals(HttpStatus.OK, response.getStatusCode()); - assertEquals(ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE, response.getBody()); - } - - @Test - public void testGetCarInformationLevel2_CarPresent() throws SQLException { - // Arrange - String id = "1"; - Map queryParams = new HashMap<>(); - queryParams.put("id", id); - - // Mock the ResultSet behavior - ResultSet mockResultSet = mock(ResultSet.class); - when(mockResultSet.next()).thenReturn(true); - - // Mock the query method of JdbcTemplate - when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))).thenAnswer(invocation -> { - ResultSetExtractor> rse = invocation.getArgument(1); - return rse.extractData(mockResultSet); - }); - - // Act - ResponseEntity response = blindSQLInjectionVulnerability.getCarInformationLevel2(queryParams); - - // Assert - assertEquals(HttpStatus.OK, response.getStatusCode()); - assertEquals("{ \"isCarPresent\": true}", response.getBody()); - } - - @Test - public void testGetCarInformationLevel2_CarNotPresent() throws SQLException { - // Arrange - String id = "2"; - Map queryParams = new HashMap<>(); - queryParams.put("id", id); - - // Mock the ResultSet behavior - ResultSet mockResultSet = mock(ResultSet.class); - when(mockResultSet.next()).thenReturn(false); - - // Mock the query method of JdbcTemplate - when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))).thenAnswer(invocation -> { - ResultSetExtractor> rse = invocation.getArgument(1); - return rse.extractData(mockResultSet); - }); - - // Act - ResponseEntity response = blindSQLInjectionVulnerability.getCarInformationLevel2(queryParams); - - // Assert - assertEquals(HttpStatus.OK, response.getStatusCode()); - assertEquals(ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE, response.getBody()); - } - - @Test - public void testGetCarInformationLevel3_CarPresent() throws SQLException { - // Arrange - String id = "1"; - Map queryParams = new HashMap<>(); - queryParams.put("id", id); - - // Mock the ResultSet behavior - ResultSet mockResultSet = mock(ResultSet.class); - when(mockResultSet.next()).thenReturn(true); - - // Mock the query method of JdbcTemplate - when(jdbcTemplate.query((PreparedStatementCreator) any(), any(), any(ResultSetExtractor.class))).thenAnswer(invocation -> { - ResultSetExtractor> rse = invocation.getArgument(2); - return rse.extractData(mockResultSet); - }); - - // Act - ResponseEntity response = blindSQLInjectionVulnerability.getCarInformationLevel3(queryParams); - - // Assert - assertEquals(HttpStatus.OK, response.getStatusCode()); - assertEquals("{ \"isCarPresent\": true}", response.getBody()); - } - - @Test - public void testGetCarInformationLevel3_CarNotPresent() throws SQLException { - // Arrange - String id = "2"; - Map queryParams = new HashMap<>(); - queryParams.put("id", id); - - // Mock the ResultSet behavior - ResultSet mockResultSet = mock(ResultSet.class); - when(mockResultSet.next()).thenReturn(false); - - // Mock the query method of JdbcTemplate - when(jdbcTemplate.query((PreparedStatementCreator) any(), any(), any(ResultSetExtractor.class))).thenAnswer(invocation -> { - ResultSetExtractor> rse = invocation.getArgument(2); - return rse.extractData(mockResultSet); - }); - - // Act - ResponseEntity response = blindSQLInjectionVulnerability.getCarInformationLevel3(queryParams); - - // Assert - assertEquals(HttpStatus.OK, response.getStatusCode()); - assertEquals(ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE, response.getBody()); - } + @Mock private JdbcTemplate jdbcTemplate; + + @InjectMocks private BlindSQLInjectionVulnerability blindSQLInjectionVulnerability; + + @BeforeEach + public void setUp() { + MockitoAnnotations.openMocks(this); + } + + @Test + public void testGetCarInformationLevel1_CarPresent() throws SQLException { + // Arrange + String id = "1"; + Map queryParams = new HashMap<>(); + queryParams.put("id", id); + + // The query is simulated to have returned a result (i.e. there is a car with ID "1") + ResultSet mockResultSet = mock(ResultSet.class); + when(mockResultSet.next()).thenReturn(true); + + // return rse.extractData(mockResultSet); indicates that the ResultSetExtractor extracts the + // data from the mockResultSet (which mocks the query result) + when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))) + .thenAnswer( + invocation -> { + ResultSetExtractor> rse = invocation.getArgument(1); + + return rse.extractData(mockResultSet); + }); + + // Act + ResponseEntity response = + blindSQLInjectionVulnerability.getCarInformationLevel1(queryParams); + + // Assert + assertEquals(HttpStatus.OK, response.getStatusCode()); + assertEquals("{ \"isCarPresent\": true}", response.getBody()); + } + + @Test + public void testGetCarInformationLevel1_CarNotPresent() throws SQLException { + // Arrange + String id = "2"; + Map queryParams = new HashMap<>(); + queryParams.put("id", id); + + // The query is simulated to have returned a result (i.e. there is no a car with ID "2") + ResultSet mockResultSet = mock(ResultSet.class); + when(mockResultSet.next()).thenReturn(false); + + // return rse.extractData(mockResultSet); indicates that the ResultSetExtractor extracts the + // data from the mockResultSet (which mocks the query result) + when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))) + .thenAnswer( + invocation -> { + ResultSetExtractor> rse = invocation.getArgument(1); + return rse.extractData(mockResultSet); + }); + + // Act + ResponseEntity response = + blindSQLInjectionVulnerability.getCarInformationLevel1(queryParams); + + // Assert + assertEquals(HttpStatus.OK, response.getStatusCode()); + assertEquals( + ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE, response.getBody()); + } + + @Test + public void testGetCarInformationLevel2_CarPresent() throws SQLException { + // Arrange + String id = "1"; + Map queryParams = new HashMap<>(); + queryParams.put("id", id); + + // Mock the ResultSet behavior + ResultSet mockResultSet = mock(ResultSet.class); + when(mockResultSet.next()).thenReturn(true); + + // Mock the query method of JdbcTemplate + when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))) + .thenAnswer( + invocation -> { + ResultSetExtractor> rse = invocation.getArgument(1); + return rse.extractData(mockResultSet); + }); + + // Act + ResponseEntity response = + blindSQLInjectionVulnerability.getCarInformationLevel2(queryParams); + + // Assert + assertEquals(HttpStatus.OK, response.getStatusCode()); + assertEquals("{ \"isCarPresent\": true}", response.getBody()); + } + + @Test + public void testGetCarInformationLevel2_CarNotPresent() throws SQLException { + // Arrange + String id = "2"; + Map queryParams = new HashMap<>(); + queryParams.put("id", id); + + // Mock the ResultSet behavior + ResultSet mockResultSet = mock(ResultSet.class); + when(mockResultSet.next()).thenReturn(false); + + // Mock the query method of JdbcTemplate + when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class))) + .thenAnswer( + invocation -> { + ResultSetExtractor> rse = invocation.getArgument(1); + return rse.extractData(mockResultSet); + }); + + // Act + ResponseEntity response = + blindSQLInjectionVulnerability.getCarInformationLevel2(queryParams); + + // Assert + assertEquals(HttpStatus.OK, response.getStatusCode()); + assertEquals( + ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE, response.getBody()); + } + + @Test + public void testGetCarInformationLevel3_CarPresent() throws SQLException { + // Arrange + String id = "1"; + Map queryParams = new HashMap<>(); + queryParams.put("id", id); + + // Mock the ResultSet behavior + ResultSet mockResultSet = mock(ResultSet.class); + when(mockResultSet.next()).thenReturn(true); + + // Mock the query method of JdbcTemplate + when(jdbcTemplate.query((PreparedStatementCreator) any(), any(), any(ResultSetExtractor.class))) + .thenAnswer( + invocation -> { + ResultSetExtractor> rse = invocation.getArgument(2); + return rse.extractData(mockResultSet); + }); + + // Act + ResponseEntity response = + blindSQLInjectionVulnerability.getCarInformationLevel3(queryParams); + + // Assert + assertEquals(HttpStatus.OK, response.getStatusCode()); + assertEquals("{ \"isCarPresent\": true}", response.getBody()); + } + + @Test + public void testGetCarInformationLevel3_CarNotPresent() throws SQLException { + // Arrange + String id = "2"; + Map queryParams = new HashMap<>(); + queryParams.put("id", id); + + // Mock the ResultSet behavior + ResultSet mockResultSet = mock(ResultSet.class); + when(mockResultSet.next()).thenReturn(false); + + // Mock the query method of JdbcTemplate + when(jdbcTemplate.query((PreparedStatementCreator) any(), any(), any(ResultSetExtractor.class))) + .thenAnswer( + invocation -> { + ResultSetExtractor> rse = invocation.getArgument(2); + return rse.extractData(mockResultSet); + }); + + // Act + ResponseEntity response = + blindSQLInjectionVulnerability.getCarInformationLevel3(queryParams); + + // Assert + assertEquals(HttpStatus.OK, response.getStatusCode()); + assertEquals( + ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE, response.getBody()); + } }