mirror of
https://github.com/ansible-collections/community.general.git
synced 2025-07-08 14:20:04 -07:00
Add trust_input to postgresql_user_obj_stat_info (#310)
Have added a trust_input option to the postgresql_user_obj_stat_info module. This only checks the session_role since all other options are passed as parameters.
This commit is contained in:
parent
159e2bb734
commit
571837b199
3 changed files with 33 additions and 0 deletions
|
@ -1,3 +1,4 @@
|
|||
---
|
||||
# Copyright: (c) 2019, Andrew Klychkov (@Andersson007) <aaklychkov@mail.ru>
|
||||
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
|
||||
|
@ -156,6 +157,20 @@
|
|||
- result is failed
|
||||
- result.msg == "Schema 'nonexistent' does not exist"
|
||||
|
||||
# 4. Test Trust Input
|
||||
- name: Try running with SQL injection
|
||||
<<: *task_parameters
|
||||
postgresql_user_obj_stat_info:
|
||||
<<: *pg_parameters
|
||||
session_role: 'curious.anonymous"; SELECT * FROM information_schema.tables; --'
|
||||
trust_input: no
|
||||
ignore_errors: yes
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- result is failed
|
||||
- result.msg is search('is potentially dangerous')
|
||||
|
||||
##########
|
||||
# Clean up
|
||||
##########
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue