Skip to content

Conversation

@mphillips-infoblox
Copy link
Contributor

This pull request enhances the query package by adding validation for field identifiers in sorting criteria and introducing tests to ensure robustness against SQL injection attempts. Key changes include the addition of a regular expression for field validation, updates to the ParseSorting function to enforce this validation, and new test cases to verify these improvements.

Validation Enhancements:

  • query/sorting.go: Introduced FieldIdentifierRegex, a regular expression to validate field names in sorting criteria. This ensures that field names follow a predefined format.
  • query/sorting.go: Updated the ParseSorting function to validate field names using FieldIdentifierRegex and to check for empty field names, returning appropriate error messages when validation fails.

Test Improvements:

  • query/sorting_test.go: Added a new test case, TestParseSortingInjection, to verify that the ParseSorting function handles invalid input and prevents SQL injection attempts.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants