|
| 1 | +"""Tests for DoS prevention mechanisms in sqlparse.""" |
| 2 | + |
| 3 | +import pytest |
| 4 | +import sqlparse |
| 5 | +import time |
| 6 | + |
| 7 | + |
| 8 | +class TestDoSPrevention: |
| 9 | + """Test cases to ensure sqlparse is protected against DoS attacks.""" |
| 10 | + |
| 11 | + def test_large_tuple_list_performance(self): |
| 12 | + """Test that parsing a large list of tuples doesn't cause DoS.""" |
| 13 | + # Generate SQL with many tuples (like Django composite primary key queries) |
| 14 | + sql = ''' |
| 15 | + SELECT "composite_pk_comment"."tenant_id", "composite_pk_comment"."comment_id" |
| 16 | + FROM "composite_pk_comment" |
| 17 | + WHERE ("composite_pk_comment"."tenant_id", "composite_pk_comment"."comment_id") IN (''' |
| 18 | + |
| 19 | + # Generate 5000 tuples - this would previously cause a hang |
| 20 | + tuples = [] |
| 21 | + for i in range(1, 5001): |
| 22 | + tuples.append(f"(1, {i})") |
| 23 | + |
| 24 | + sql += ", ".join(tuples) + ")" |
| 25 | + |
| 26 | + # Test should complete quickly (under 5 seconds) |
| 27 | + start_time = time.time() |
| 28 | + result = sqlparse.format(sql, reindent=True, keyword_case="upper") |
| 29 | + execution_time = time.time() - start_time |
| 30 | + |
| 31 | + assert execution_time < 5.0, f"Parsing took too long: {execution_time:.2f}s" |
| 32 | + assert len(result) > 0, "Result should not be empty" |
| 33 | + assert "SELECT" in result.upper(), "SQL should be properly formatted" |
| 34 | + |
| 35 | + def test_deeply_nested_groups_limited(self): |
| 36 | + """Test that deeply nested groups don't cause stack overflow.""" |
| 37 | + # Create deeply nested parentheses |
| 38 | + sql = "SELECT " + "(" * 200 + "1" + ")" * 200 |
| 39 | + |
| 40 | + # Should not raise RecursionError |
| 41 | + result = sqlparse.format(sql, reindent=True) |
| 42 | + assert "SELECT" in result |
| 43 | + assert "1" in result |
| 44 | + |
| 45 | + def test_very_large_token_list_limited(self): |
| 46 | + """Test that very large token lists are handled gracefully.""" |
| 47 | + # Create a SQL with many identifiers |
| 48 | + identifiers = [] |
| 49 | + for i in range(15000): # More than MAX_GROUPING_TOKENS |
| 50 | + identifiers.append(f"col{i}") |
| 51 | + |
| 52 | + sql = f"SELECT {', '.join(identifiers)} FROM table1" |
| 53 | + |
| 54 | + # Should complete without hanging |
| 55 | + start_time = time.time() |
| 56 | + result = sqlparse.format(sql, reindent=True) |
| 57 | + execution_time = time.time() - start_time |
| 58 | + |
| 59 | + assert execution_time < 10.0, f"Parsing took too long: {execution_time:.2f}s" |
| 60 | + assert "SELECT" in result |
| 61 | + assert "FROM" in result |
| 62 | + |
| 63 | + def test_normal_sql_still_works(self): |
| 64 | + """Test that normal SQL still works correctly after DoS protections.""" |
| 65 | + sql = """ |
| 66 | + SELECT u.id, u.name, p.title |
| 67 | + FROM users u |
| 68 | + JOIN posts p ON u.id = p.user_id |
| 69 | + WHERE u.active = 1 |
| 70 | + AND p.published_at > '2023-01-01' |
| 71 | + ORDER BY p.published_at DESC |
| 72 | + """ |
| 73 | + |
| 74 | + result = sqlparse.format(sql, reindent=True, keyword_case="upper") |
| 75 | + |
| 76 | + assert "SELECT" in result |
| 77 | + assert "FROM" in result |
| 78 | + assert "JOIN" in result |
| 79 | + assert "WHERE" in result |
| 80 | + assert "ORDER BY" in result |
| 81 | + |
| 82 | + def test_reasonable_tuple_list_works(self): |
| 83 | + """Test that reasonable-sized tuple lists still work correctly.""" |
| 84 | + sql = ''' |
| 85 | + SELECT id FROM table1 |
| 86 | + WHERE (col1, col2) IN (''' |
| 87 | + |
| 88 | + # 100 tuples should work fine |
| 89 | + tuples = [] |
| 90 | + for i in range(1, 101): |
| 91 | + tuples.append(f"({i}, {i * 2})") |
| 92 | + |
| 93 | + sql += ", ".join(tuples) + ")" |
| 94 | + |
| 95 | + result = sqlparse.format(sql, reindent=True, keyword_case="upper") |
| 96 | + |
| 97 | + assert "SELECT" in result |
| 98 | + assert "WHERE" in result |
| 99 | + assert "IN" in result |
| 100 | + assert "1," in result # First tuple should be there |
| 101 | + assert "200" in result # Last tuple should be there |
0 commit comments