Changeset 41470 for trunk/tests/phpunit/tests/db.php

Timestamp:

09/19/2017 02:47:46 PM (7 years ago)

Author:

aaroncampbell

Message:

Database: Hardening for wpdb::prepare()

Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.

File:

• trunk/tests/phpunit/tests/db.php (modified) (1 diff)

trunk/tests/phpunit/tests/db.php

@@ -355 +355 @@
     }
 
+    function test_prepare_sprintf() {
+        global $wpdb;
+
+        $prepared = $wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", 1, "admin" );
+        $this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 1 AND user_login = 'admin'", $prepared );
+    }
+
+    /**
+     * @expectedIncorrectUsage wpdb::prepare
+     */
+    function test_prepare_sprintf_invalid_args() {
+        global $wpdb;
+
+        $prepared = @$wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", 1, array( "admin" ) );
+        $this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 1 AND user_login = ''", $prepared );
+
+        $prepared = @$wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", array( 1 ), "admin" );
+        $this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 0 AND user_login = 'admin'", $prepared );
+    }
+
+        function test_prepare_vsprintf() {
+                global $wpdb;
+
+        $prepared = $wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", array( 1, "admin" ) );
+        $this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 1 AND user_login = 'admin'", $prepared );
+    }
+
+    /**
+     * @expectedIncorrectUsage wpdb::prepare
+     */
+    function test_prepare_vsprintf_invalid_args() {
+        global $wpdb;
+
+        $prepared = @$wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", array( 1, array( "admin" ) ) );
+        $this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 1 AND user_login = ''", $prepared );
+
+        $prepared = @$wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", array( array( 1 ), "admin" ) );
+        $this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 0 AND user_login = 'admin'", $prepared );
+        }
+
     function test_db_version() {
         global $wpdb;