|
## SQL validator -- exhaustive edge-case tests.
|
|
## Auto-generated. Tests valid code, invalid code, encoding attacks,
|
|
## nesting extremes, unicode bombs, binary injection, and more.
|
|
|
|
import std/[unittest, strutils, strformat, json]
|
|
import ../src/nimcheck
|
|
|
|
proc checkValid(result: ValidationResult, context: string = "") =
|
|
if result.errors.len > 0:
|
|
var msg = &"Expected valid, got {result.errors.len} error(s)"
|
|
if context.len > 0: msg.add(&" [{context}]")
|
|
for e in result.errors: msg.add(&"\n [{e.code}] {e.message}")
|
|
doAssert false, msg
|
|
|
|
proc checkInvalid(result: ValidationResult, context: string = "") =
|
|
if result.errors.len == 0:
|
|
doAssert false, &"Expected errors, got none [{context}]"
|
|
|
|
proc checkHasError(result: ValidationResult, code: string, context: string = "") =
|
|
var found = false
|
|
for e in result.errors:
|
|
if e.code == code: found = true
|
|
if not found:
|
|
var codes: seq[string] = @[]
|
|
for e in result.errors: codes.add(e.code)
|
|
let codesJoined = codes.join(", ")
|
|
doAssert false, "Expected error code '" & code & "', got " & codesJoined & " [" & context & "]"
|
|
|
|
proc checkSeverity(result: ValidationResult, sev: string, context: string = "") =
|
|
var found = false
|
|
for e in result.errors:
|
|
if $e.severity == sev: found = true
|
|
if not found:
|
|
doAssert false, &"Expected severity '{sev}', none found [{context}]"
|
|
|
|
suite "SQL Exhaustive Tests":
|
|
|
|
test "basic SELECT":
|
|
let src = "SELECT * FROM users;\n"
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|
|
|
|
test "JOIN query":
|
|
let src = "SELECT u.name, o.total\nFROM users u\nINNER JOIN orders o ON u.id = o.user_id\nWHERE o.total > 100\nORDER BY o.total DESC;\n"
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|
|
|
|
test "subquery":
|
|
let src = "SELECT name FROM users WHERE id IN (SELECT user_id FROM orders);\n"
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|
|
|
|
test "CREATE TABLE":
|
|
let src = "CREATE TABLE users (\n id INT PRIMARY KEY,\n name VARCHAR(100) NOT NULL,\n email VARCHAR(255) UNIQUE\n);\n"
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|
|
|
|
test "INSERT with values":
|
|
let src = "INSERT INTO users (id, name, email) VALUES (1, 'Alice', 'alice@example.com');\n"
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|
|
|
|
test "UPDATE with WHERE":
|
|
let src = "UPDATE users SET active = 1 WHERE last_login > '2024-01-01';\n"
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|
|
|
|
test "DELETE with subquery":
|
|
let src = "DELETE FROM users WHERE id NOT IN (SELECT DISTINCT user_id FROM orders);\n"
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|
|
|
|
test "aggregate functions":
|
|
let src = "SELECT COUNT(*), AVG(price), MAX(amount), MIN(qty), SUM(total)\nFROM items;\n"
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|
|
|
|
test "GROUP BY with HAVING":
|
|
let src = "SELECT dept, COUNT(*) as cnt\nFROM employees\nGROUP BY dept\nHAVING cnt > 5;\n"
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|
|
|
|
test "empty source":
|
|
let src = ""
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|
|
|
|
test "null byte injection":
|
|
let src = "SELECT 1;\x00SELECT 2;\n"
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|
|
|
|
test "string with escaped quote":
|
|
let src = "SELECT 'O''Brien' AS name;\n"
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|
|
|
|
test "CTE with WITH":
|
|
let src = "WITH regional_sales AS (\n SELECT region, SUM(amount) AS total\n FROM orders\n GROUP BY region\n)\nSELECT * FROM regional_sales;\n"
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|
|
|
|
test "CREATE INDEX":
|
|
let src = "CREATE INDEX idx_users_email ON users(email);\n"
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|
|
|
|
test "only comments":
|
|
let src = "-- just a comment\n \n/* multi\nline */\n"
|
|
let result = validateSource(src, flavor = lfSQL)
|
|
check result.errors.len >= 0
|