53 lines
1.3 KiB
Go
53 lines
1.3 KiB
Go
package db
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"runtime/trace"
|
|
"testing"
|
|
|
|
"xorm.io/xorm"
|
|
"xorm.io/xorm/contexts"
|
|
)
|
|
|
|
type followingQueryHook struct{}
|
|
|
|
func (followingQueryHook) BeforeProcess(c *contexts.ContextHook) (context.Context, error) {
|
|
return c.Ctx, nil
|
|
}
|
|
func (followingQueryHook) AfterProcess(*contexts.ContextHook) error { return nil }
|
|
|
|
func TestTracingContextSurvivesFollowingHooks(t *testing.T) {
|
|
for _, sensitive := range []bool{false, true} {
|
|
for _, fail := range []bool{false, true} {
|
|
engine, err := xorm.NewEngine("sqlite3", ":memory:")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
engine.AddHook(TracingHook{}, followingQueryHook{})
|
|
ctx := context.Background()
|
|
if sensitive {
|
|
ctx = WithSensitiveSQL(ctx)
|
|
}
|
|
var output bytes.Buffer
|
|
if err := trace.Start(&output); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
func() {
|
|
defer trace.Stop()
|
|
query := "SELECT ?"
|
|
if fail {
|
|
query = "SELECT missing_synthetic_function(?)"
|
|
}
|
|
_, err = engine.Context(ctx).Exec(query, "synthetic-following-hook-sentinel")
|
|
}()
|
|
_ = engine.Close()
|
|
if (err != nil) != fail {
|
|
t.Fatal("unexpected real SQLite query outcome")
|
|
}
|
|
if bytes.Contains(output.Bytes(), []byte("synthetic-following-hook-sentinel")) == sensitive {
|
|
t.Fatal("following hook changed private or ordinary trace disclosure")
|
|
}
|
|
}
|
|
}
|
|
}
|