Skip to content

Commit

Permalink
Verify SQL injection attempts generate HTTP response 403
Browse files Browse the repository at this point in the history
  • Loading branch information
nigelhorne committed Oct 18, 2024
1 parent 17d1949 commit 6728104
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 1 deletion.
4 changes: 4 additions & 0 deletions lib/CGI/Info.pm
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,10 @@ CGI::Info attempts to remove that.
Furthermore, to aid script debugging, CGI::Info attempts to do sensible
things when you're not running the program in a CGI environment.
CGI::Info also provides a simple web application firewall.
Whilst you shouldn't rely on it alone to provide security to your website,
it is another layer and every little helps.
use CGI::Info;
my $info = CGI::Info->new();
# ...
Expand Down
4 changes: 3 additions & 1 deletion t/params.t
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

use strict;
use warnings;
use Test::Most tests => 179;
use Test::Most tests => 181;
use Test::NoWarnings;
use File::Spec;
use lib 't/lib';
Expand Down Expand Up @@ -96,13 +96,15 @@ PARAMS: {
$i = new_ok('CGI::Info');
ok(!defined($i->params()));
ok($i->as_string() eq '');
cmp_ok($i->status(), '==', 403, 'SQL Injection generates 403 code');

# Seen in vwf.log
$ENV{'QUERY_STRING'} = 'entry=-4346" OR 1749\=1749 AND "dgiO"\="dgiO;page=people';
$i = new_ok('CGI::Info');
ok(!defined($i->params()));
ok(!defined($i->entry()));
ok($i->as_string() eq '');
cmp_ok($i->status(), '==', 403, 'SQL Injection generates 403 code');

$ENV{'QUERY_STRING'} = '<script>alert(123)</script>=wilma';
$i = new_ok('CGI::Info');
Expand Down

0 comments on commit 6728104

Please sign in to comment.