fleet/server/service/service_queries_test.go
Zach Wasserman 5b432cccee
Prevent SQLite ATTACH from being used in queries (#129)
Mitigate
[CVE-2020-26273](https://github.com/osquery/osquery/security/advisories/GHSA-4g56-2482-x7q8)
by attempting to prevent users from executing or saving queries that use
the SQLite `ATTACH` command.

Users must still update to osquery 4.6.0 to ensure the functionality is
fully disabled in osquery.
2020-12-14 18:13:34 -08:00

25 lines
476 B
Go

package service
import (
"context"
"testing"
"github.com/fleetdm/fleet/server/kolide"
"github.com/fleetdm/fleet/server/mock"
"github.com/stretchr/testify/require"
)
func TestNewQueryAttach(t *testing.T) {
ds := new(mock.Store)
svc, err := newTestService(ds, nil, nil)
require.Nil(t, err)
name := "bad"
query := "attach '/nope' as bad"
_, err = svc.NewQuery(
context.Background(),
kolide.QueryPayload{Name: &name, Query: &query},
)
require.Error(t, err)
}