Skip to content

Commit 5c1a5ba

Browse files
jeongsoolee09jeongsoolee09
committed
Checkpoint
1 parent 8a99661 commit 5c1a5ba

File tree

1 file changed

+187
-11
lines changed
  • javascript/frameworks/cap/test/queries/cqlinjection/srv

1 file changed

+187
-11
lines changed

‎javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js‎

Lines changed: 187 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,42 +3,135 @@ const cds = require("@sap/cds");
33
module.exports = class Service1 extends cds.ApplicationService {
44
init() {
55
/* ========== 1. Service1 running query on the database service using `cds.run` and friends using Fluent API ========== */
6-
this.on("send11", async (req) => {
6+
this.on("send00111", async (req) => {
77
const { id } = req.data;
88
const query = SELECT.from`Entity1`.where("ID=" + id);
99
cds.run(query);
1010
});
1111

12-
this.on("send12", async (req) => {
12+
this.on("send00112", async (req) => {
13+
const { id } = req.data;
14+
const query = SELECT.from`Entity1`.where(`ID=` + id);
15+
cds.run(query);
16+
});
17+
18+
this.on("send00113", async (req) => {
19+
const { id } = req.data;
20+
const query = SELECT.from`Entity1`.where(`ID=${id}`);
21+
cds.run(query);
22+
});
23+
24+
this.on("send00114", async (req) => {
25+
const { id } = req.data;
26+
const query = SELECT.from`Entity1`.where`ID=${id}`;
27+
cds.run(query);
28+
});
29+
30+
this.on("send00121", async (req) => {
1331
const { id } = req.data;
1432
cds.read("Entity1").where("ID =" + id);
1533
});
1634

17-
this.on("send13", async (req) => {
35+
this.on("send00122", async (req) => {
36+
const { id } = req.data;
37+
cds.read("Entity1").where(`ID =` + id);
38+
});
39+
40+
this.on("send00123", async (req) => {
41+
const { id } = req.data;
42+
cds.read("Entity1").where(`ID=${id}`);
43+
});
44+
45+
this.on("send00124", async (req) => {
46+
const { id } = req.data;
47+
cds.read("Entity1").where`ID=${id}`;
48+
});
49+
50+
this.on("send00131", async (req) => {
1851
const { id } = req.data;
1952
cds.create("Entity1").entries({id: "" + id});
2053
});
2154

22-
this.on("send14", async (req) => {
55+
this.on("send00132", async (req) => {
56+
const { id } = req.data;
57+
cds.create("Entity1").entries({id: `` + id});
58+
});
59+
60+
this.on("send00133", async (req) => {
61+
const { id } = req.data;
62+
cds.create("Entity1").entries({id: `${id}`});
63+
});
64+
65+
this.on("send00141", async (req) => {
2366
const { id, amount } = req.data;
2467
cds.update("Entity1").set("col1 = col1" + amount).where("col1 = " + id);
2568
});
2669

27-
this.on("send15", async (req) => {
70+
this.on("send00142", async (req) => {
71+
const { id, amount } = req.data;
72+
cds.update("Entity1").set("col1 = col1" + amount).where(`col1 = ` + id);
73+
});
74+
75+
this.on("send00143", async (req) => {
76+
const { id, amount } = req.data;
77+
cds.update("Entity1").set("col1 = col1" + amount).where(`col1 = ${id}`);
78+
});
79+
80+
this.on("send00144", async (req) => {
81+
const { id, amount } = req.data;
82+
cds.update("Entity1").set("col1 = col1" + amount).where`col1 = ${id}`;
83+
});
84+
85+
this.on("send00151", async (req) => {
2886
const { id } = req.data;
2987
cds.insert("Entity1").entries({id: "" + id});
3088
});
3189

32-
this.on("send16", async (req) => {
90+
this.on("send00152", async (req) => {
91+
const { id } = req.data;
92+
cds.insert("Entity1").entries({id: `` + id});
93+
});
94+
95+
this.on("send00153", async (req) => {
96+
const { id } = req.data;
97+
cds.insert("Entity1").entries({id: `${id}`});
98+
});
99+
100+
this.on("send00161", async (req) => {
33101
const { id } = req.data;
34102
cds.upsert("Entity1").entries({id: "" + id});
35103
});
36104

37-
this.on("send17", async (req) => {
105+
this.on("send00162", async (req) => {
106+
const { id } = req.data;
107+
cds.upsert("Entity1").entries({id: `` + id});
108+
});
109+
110+
this.on("send00163", async (req) => {
111+
const { id } = req.data;
112+
cds.upsert("Entity1").entries({id: `${id}`});
113+
});
114+
115+
this.on("send00171", async (req) => {
38116
const { id } = req.data;
39117
cds.delete("Entity1").where("ID =" + id);
40118
});
41119

120+
this.on("send00172", async (req) => {
121+
const { id } = req.data;
122+
cds.delete("Entity1").where(`ID =` + id);
123+
});
124+
125+
this.on("send00173", async (req) => {
126+
const { id } = req.data;
127+
cds.delete("Entity1").where(`ID = ${id}`);
128+
});
129+
130+
this.on("send00174", async (req) => {
131+
const { id } = req.data;
132+
cds.delete("Entity1").where`ID = ${id}`;
133+
});
134+
42135
/* ========== 2. Service1 running query on itself by `await`-ing the query ========== */
43136
this.on("send21", async (req) => {
44137
const { id } = req.data;
@@ -152,24 +245,69 @@ module.exports = class Service1 extends cds.ApplicationService {
152245
});
153246

154247
/* ========== 5. Service1 running query on Service2 using CQN parsed with `cds.ql` ========== */
155-
this.on("send5", async (req) => {
248+
this.on("send51", async (req) => {
156249
const { id } = req.data;
157250
const Service2 = await cds.connect.to("Service2");
158251
const query = cds.ql("SELECT * from Service1Entity where ID =" + id);
159252
Service2.run(query);
160253
});
161254

255+
this.on("send51", async (req) => {
256+
const { id } = req.data;
257+
const Service2 = await cds.connect.to("Service2");
258+
const query = cds.ql(`SELECT * from Service1Entity where ID =` + id);
259+
Service2.run(query);
260+
});
261+
262+
this.on("send53", async (req) => {
263+
const { id } = req.data;
264+
const Service2 = await cds.connect.to("Service2");
265+
const query = cds.ql(`SELECT * from Service1Entity where ID = ${id}`);
266+
Service2.run(query);
267+
});
268+
269+
this.on("send54", async (req) => {
270+
const { id } = req.data;
271+
const Service2 = await cds.connect.to("Service2");
272+
const query = cds.ql`SELECT * from Service1Entity where ID = ${id}`;
273+
Service2.run(query);
274+
});
275+
162276
/* ========== 6. Service1 running query on the database service using CQN parsed with `cds.parse.cql` ========== */
163-
this.on("send6", async (req) => {
277+
this.on("send61", async (req) => {
278+
const { id } = req.data;
279+
const query = cds.parse.cql("SELECT * from Entity1 where ID =" + id);
280+
cds.run(query);
281+
});
282+
283+
this.on("send62", async (req) => {
164284
const { id } = req.data;
165285
const query = cds.parse.cql(`SELECT * from Entity1 where ID =` + id);
166286
cds.run(query);
167287
});
168288

289+
this.on("send63", async (req) => {
290+
const { id } = req.data;
291+
const query = cds.parse.cql(`SELECT * from Entity1 where ID = ${id}`);
292+
cds.run(query);
293+
});
294+
295+
this.on("send64", async (req) => {
296+
const { id } = req.data;
297+
const query = cds.parse.cql`SELECT * from Entity1 where ID = ${id}`;
298+
cds.run(query);
299+
});
300+
169301
/* ========== 7. Service1 running query on the database service using CQN parsed with global function `CQL` ========== */
170-
this.on("send7", async (req) => {
302+
this.on("send71", async (req) => {
171303
const { id } = req.data;
172-
const query = CQL(`SELECT * from Entity1 where ID =` + id);
304+
const query = CQL(`SELECT * from Entity1 where ID =` + id); // TP
305+
cds.run(query);
306+
});
307+
308+
this.on("send72", async (req) => {
309+
const { id } = req.data;
310+
const query = CQL`SELECT * from Entity1 where ID =` + id; // FP
173311
cds.run(query);
174312
});
175313

@@ -391,5 +529,43 @@ module.exports = class Service1 extends cds.ApplicationService {
391529
tx.delete(`Entity1`).where("ID =" + id);
392530
});
393531
});
532+
533+
/* ========== 13. Service1 running query on the database service using `cds.run` and friends using Fluent API ========== */
534+
this.on("send131", async (req) => {
535+
const { id } = req.data;
536+
const query = SELECT.from`Entity1`.where("ID=" + id);
537+
cds.db.run(query);
538+
});
539+
540+
this.on("send132", async (req) => {
541+
const { id } = req.data;
542+
cds.db.read("Entity1").where("ID =" + id);
543+
});
544+
545+
this.on("send133", async (req) => {
546+
const { id } = req.data;
547+
cds.db.create("Entity1").entries({id: "" + id});
548+
});
549+
550+
this.on("send134", async (req) => {
551+
const { id, amount } = req.data;
552+
cds.db.update("Entity1").set("col1 = col1" + amount).where("col1 = " + id);
553+
});
554+
555+
this.on("send135", async (req) => {
556+
const { id } = req.data;
557+
cds.db.insert("Entity1").entries({id: "" + id});
558+
});
559+
560+
this.on("send136", async (req) => {
561+
const { id } = req.data;
562+
cds.db.upsert("Entity1").entries({id: "" + id});
563+
});
564+
565+
this.on("send137", async (req) => {
566+
const { id } = req.data;
567+
cds.db.delete("Entity1").where("ID =" + id);
568+
});
569+
394570
}
395571
};

0 commit comments

Comments
 (0)