Skip to content

Commit 97e0222

Browse files
committed
Putting in a comment about the errors we expect to fail from the rails test suite.
1 parent 219e585 commit 97e0222

File tree

1 file changed

+15
-0
lines changed

1 file changed

+15
-0
lines changed

RUNNING_UNIT_TESTS

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,5 +40,20 @@ you can do so with:
4040

4141
That'll run the base suite using the SQLServer-Ruby adapter.
4242

43+
== Expected Errors
4344

45+
Currently we expect the following errors from running the test suite:
4446

47+
1. test_add_limit_offset_should_sanitize_sql_injection_for_limit_with_comas
48+
from
49+
activerecord/test/cases/adapter_test.rb
50+
51+
2. test_add_limit_offset_should_sanitize_sql_injection_for_limit_without_comas
52+
from
53+
activerecord/test/cases/adapter_test.rb
54+
55+
1. & 2. error because we treat the possible values for offset and limit much more
56+
aggressively than the intention of the tests. Rails expects that limit => '1,7 bad sql'
57+
would turn into ' limit 1,7' but that's not valid SQL Server syntax so why should we
58+
bother? So we just deny non-integer limit / offset params entirely rather than trying
59+
to sanitize them. It's a hard-line to take on sql injection, but probably a safer one.

0 commit comments

Comments
 (0)