File tree Expand file tree Collapse file tree 1 file changed +15
-0
lines changed
Expand file tree Collapse file tree 1 file changed +15
-0
lines changed Original file line number Diff line number Diff line change @@ -40,5 +40,20 @@ you can do so with:
4040
4141That'll run the base suite using the SQLServer-Ruby adapter.
4242
43+ == Expected Errors
4344
45+ Currently we expect the following errors from running the test suite:
4446
47+ 1. test_add_limit_offset_should_sanitize_sql_injection_for_limit_with_comas
48+ from
49+ activerecord/test/cases/adapter_test.rb
50+
51+ 2. test_add_limit_offset_should_sanitize_sql_injection_for_limit_without_comas
52+ from
53+ activerecord/test/cases/adapter_test.rb
54+
55+ 1. & 2. error because we treat the possible values for offset and limit much more
56+ aggressively than the intention of the tests. Rails expects that limit => '1,7 bad sql'
57+ would turn into ' limit 1,7' but that's not valid SQL Server syntax so why should we
58+ bother? So we just deny non-integer limit / offset params entirely rather than trying
59+ to sanitize them. It's a hard-line to take on sql injection, but probably a safer one.
You can’t perform that action at this time.
0 commit comments