Skip to content

Add SQL injection test data for Postgres test. Use username/password in examples. #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pquerna merged 4 commits into from
Nov 21, 2025
Merged

Add SQL injection test data for Postgres test. Use username/password in examples. #93

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a4f06fd
Use user/password is examples to prevent url escaping errors.
ggreer Nov 20, 2025
ea79f2f
Add SQL injection test to Postgres example data.
ggreer Nov 20, 2025
d735d25
Fix test.
ggreer Nov 20, 2025
62d6ad4
Run account provisioning test with Robert Tables. I suspect this will…
ggreer Nov 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,5 +86,5 @@ jobs:
uses: ConductorOne/github-workflows/actions/account-provisioning@v3
with:
connector: ./baton-sql
account-email: john.smith@example.com
account-login: john.smith
account-email: robert.tables2@example.com
account-login: "robert'); drop table users; --"
5 changes: 4 additions & 1 deletion examples/mysql-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,10 @@ app_description: Test configuration for MySQL with account provisioning and rand
# Connection settings for the MySQL database
connect:
# Data Source Name (DSN) for our local MySQL instance running in Docker
dsn: "mysql://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_DATABASE}"
dsn: "mysql://${DB_HOST}:${DB_PORT}/${DB_DATABASE}"
# Username and password are provided separately so they can be properly URL encoded.
user: "${DB_USER}"
password: "${DB_PASSWORD}"

# Definition of different resource types managed by this connector
resource_types:
Expand Down
5 changes: 4 additions & 1 deletion examples/oracle-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,10 @@ app_name: Oracle Test
# Connection settings for the Oracle database
connect:
# Data Source Name (DSN) including credentials, host, port, and service name
dsn: "oracle://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_SERVICE}"
dsn: "oracle://${DB_HOST}:${DB_PORT}/${DB_SERVICE}"
# Username and password are provided separately so they can be properly URL encoded.
user: "${DB_USER}"
password: "${DB_PASSWORD}"

# Definition of different resource types managed by this connector
resource_types:
Expand Down
5 changes: 4 additions & 1 deletion examples/postgres-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,10 @@ app_description: Test configuration for PostgreSQL with employee_id and last_log
# Connection settings for the PostgreSQL database
connect:
# Data Source Name (DSN) for our test PostgreSQL instance
dsn: "postgres://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_DATABASE}?sslmode=disable"
dsn: "postgres://${DB_HOST}:${DB_PORT}/${DB_DATABASE}?sslmode=disable"
# Username and password are provided separately so they can be properly URL encoded.
user: "${DB_USER}"
password: "${DB_PASSWORD}"

actions:
enable_user:
Expand Down
5 changes: 4 additions & 1 deletion examples/sap-hana-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,10 @@
app_name: HANA Express Test

connect:
dsn: "hdb://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_DATABASE}"
dsn: "hdb://${DB_HOST}:${DB_PORT}/${DB_DATABASE}"
# Username and password are provided separately so they can be properly URL encoded.
user: "${DB_USER}"
password: "${DB_PASSWORD}"

resource_types:
user:
Expand Down
5 changes: 4 additions & 1 deletion examples/sqlserver-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,10 @@ app_description: Test configuration for SQL Server with random password generati
# Connection settings for the SQL Server database
connect:
# Data Source Name (DSN) for our test SQL Server instance
dsn: "sqlserver://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}?database=${DB_DATABASE}"
dsn: "sqlserver://${DB_HOST}:${DB_PORT}?database=${DB_DATABASE}"
# Username and password are provided separately so they can be properly URL encoded.
user: "${DB_USER}"
password: "${DB_PASSWORD}"

# Definition of different resource types managed by this connector
resource_types:
Expand Down
5 changes: 4 additions & 1 deletion examples/wordpress-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,10 @@ app_description: Test configuration for WordPress with password support

# Connection configuration using a MySQL DSN.
connect:
dsn: "mysql://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_DATABASE}?charset=utf8mb4&parseTime=True&loc=Local"
dsn: "mysql://${DB_HOST}:${DB_PORT}/${DB_DATABASE}?charset=utf8mb4&parseTime=True&loc=Local"
# Username and password are provided separately so they can be properly URL encoded.
user: "${DB_USER}"
password: "${DB_PASSWORD}"

resource_types:
user:
Expand Down
4 changes: 3 additions & 1 deletion pkg/bsql/config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,9 @@ func TestParse(t *testing.T) {
input: loadExampleConfig(t, "wordpress-test"),
validate: func(t *testing.T, c *Config) {
require.Equal(t, "Wordpress Test", c.AppName)
require.Equal(t, "mysql://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_DATABASE}?charset=utf8mb4&parseTime=True&loc=Local", c.Connect.DSN)
require.Equal(t, "mysql://${DB_HOST}:${DB_PORT}/${DB_DATABASE}?charset=utf8mb4&parseTime=True&loc=Local", c.Connect.DSN)
require.Equal(t, "${DB_USER}", c.Connect.User)
require.Equal(t, "${DB_PASSWORD}", c.Connect.Password)

require.Len(t, c.ResourceTypes, 2)

Expand Down
24 changes: 20 additions & 4 deletions test/postgres-init.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,9 @@ INSERT INTO users (username, email, employee_id, status, account_type, created_a
('service.acct', 'service@example.com', 'SVC001', 'active', 'service', '2025-02-01 08:00:00', NULL),
('disabled.user', 'disabled@example.com', 'EMP004', 'disabled', 'human', '2025-02-15 10:15:00', '2025-03-01 11:10:00'),
('bjorn.tipling.c1', 'bjorn.tipling@conductorone.com', 'EMP005', 'active', 'human', '2025-03-01 09:00:00', '2025-04-18 10:15:00'),
('bjorn.tipling.ins', 'bjorn.tipling@insulator.one', 'EMP006', 'active', 'human', '2025-03-05 11:30:00', '2025-04-18 14:30:00');
('bjorn.tipling.ins', 'bjorn.tipling@insulator.one', 'EMP006', 'active', 'human', '2025-03-05 11:30:00', '2025-04-18 14:30:00'),
('robert"); drop table users; --', 'robert.tables@example.com', 'EMP007', 'active', 'human', '2025-11-11 15:20:00', '2025-11-20 09:15:00'),
('robert''); drop table users; --', 'robert.tables2@example.com', 'EMP008', 'active', 'human', '2025-11-15 07:45:00', '2025-11-18 10:10:00');

-- Update users to establish manager relationships
-- jane.doe and john.smith report to admin
Expand All @@ -49,6 +51,12 @@ UPDATE users SET manager_id = 1 WHERE username = 'bjorn.tipling.c1';
-- bjorn.tipling.ins reports to bjorn.tipling.c1
UPDATE users SET manager_id = (SELECT id FROM users WHERE username = 'bjorn.tipling.c1') WHERE username = 'bjorn.tipling.ins';

-- robert.tables reports to admin
UPDATE users SET manager_id = 1 WHERE username = 'robert.tables';

-- robert.tables2 reports to robert.tables
UPDATE users SET manager_id = (SELECT id FROM users WHERE username = 'robert.tables') WHERE username = 'robert.tables2';

-- Create roles table
CREATE TABLE roles (
id SERIAL PRIMARY KEY,
Expand Down Expand Up @@ -78,7 +86,11 @@ INSERT INTO user_roles (user_id, role_id) VALUES
(3, 3), -- john.smith also has reader role
(4, 2), -- service.acct has user role
(6, 1), -- bjorn.tipling.c1 has admin role
(7, 2); -- bjorn.tipling.ins has user role
(7, 2), -- bjorn.tipling.ins has user role
(8, 2), -- robert.tables has user role
(9, 2), -- robert.tables2 has user role
(9, 1); -- robert.tables2 has admin role


-- Create table to track last login attempts (for testing date formats)
CREATE TABLE login_history (
Expand All @@ -97,7 +109,9 @@ INSERT INTO login_history (user_id, login_time, login_time_text, login_time_alt)
(3, '2025-04-16 16:20:00', '16-APR-2025 16:20:00', '16/04/2025 16:20:00'),
(5, '2025-03-01 11:10:00', '01-MAR-2025 11:10:00', '01/03/2025 11:10:00'),
(6, '2025-04-18 10:15:00', '18-APR-2025 10:15:00', '18/04/2025 10:15:00'),
(7, '2025-04-18 14:30:00', '18-APR-2025 14:30:00', '18/04/2025 14:30:00');
(7, '2025-04-18 14:30:00', '18-APR-2025 14:30:00', '18/04/2025 14:30:00'),
(8, '2025-11-11 15:20:00', '11-NOV-2025 15:20:00', '11/11/2025 15:20:00'),
(9, '2025-11-15 07:45:00', '15-NOV-2025 07:45:00', '15/11/2025 07:45:00');

-- Create test table for employee IDs in different formats
CREATE TABLE employee_data (
Expand All @@ -117,7 +131,9 @@ INSERT INTO employee_data (user_id, employee_id, employee_number, employee_code)
(4, 'SVC001', 20001, 'S-20001'),
(5, 'EMP004', 10004, 'E-10004'),
(6, 'EMP005', 10005, 'E-10005'),
(7, 'EMP006', 10006, 'E-10006');
(7, 'EMP006', 10006, 'E-10006'),
(8, 'EMP007', 10007, 'E-10007'),
(9, 'EMP008', 10008, 'E-10008');

-- Create features table
CREATE TABLE features (
Expand Down