mirror of
https://github.com/empayre/fleet.git
synced 2024-11-07 17:28:54 +00:00
5b432cccee
Mitigate [CVE-2020-26273](https://github.com/osquery/osquery/security/advisories/GHSA-4g56-2482-x7q8) by attempting to prevent users from executing or saving queries that use the SQLite `ATTACH` command. Users must still update to osquery 4.6.0 to ensure the functionality is fully disabled in osquery.
25 lines
476 B
Go
25 lines
476 B
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/fleetdm/fleet/server/kolide"
|
|
"github.com/fleetdm/fleet/server/mock"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestNewQueryAttach(t *testing.T) {
|
|
ds := new(mock.Store)
|
|
svc, err := newTestService(ds, nil, nil)
|
|
require.Nil(t, err)
|
|
|
|
name := "bad"
|
|
query := "attach '/nope' as bad"
|
|
_, err = svc.NewQuery(
|
|
context.Background(),
|
|
kolide.QueryPayload{Name: &name, Query: &query},
|
|
)
|
|
require.Error(t, err)
|
|
}
|