Documentation
¶
Overview ¶
Package advcorpus is a shared adversarial-input corpus for xolu's property tests and fuzz seed corpora. It is an internal package: importable by any xolu package's tests, not part of the public API.
The corpus centralises hostile identifier strings so that every boundary that trusts an identifier — OQL field names (D-005), adapted-table schema field names (D-009), and any future identifier sink — is exercised against the same vocabulary. A single definition means a payload added here strengthens every consumer at once.
The corpus is organised by intent. SQLMetacharacters and Identifiers are the load-bearing sets for the injection property tests; the remainder broaden fuzz coverage.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var Identifiers = []string{
"",
" ",
"\t",
"\n",
"a b",
"_leading",
"1leading",
".dotstart",
"trailing.",
"a..b",
"a.b.c",
"ALLCAPS",
"MiXeD",
"name\x00null",
"name\x7f",
"café",
"ＮＡＭＥ",
"a\u200bb",
"select",
"SELECT",
"id",
"_version",
"_extra",
"created_at",
longName(64),
longName(1024),
longName(65536),
}
Identifiers is a general set of edge-case identifier shapes (not necessarily malicious) that any identifier validator should handle deterministically: boundary conditions around length, casing, leading characters, Unicode, and embedded control bytes.
var InjectionIdentifiers = []string{
`x') UNION SELECT data,_version FROM t0000_nodes--`,
`x') UNION SELECT 1--`,
`x' OR '1'='1`,
`x') OR (1=1`,
`a'||(SELECT secret FROM t0000_nodes)||'`,
`evil TEXT); DROP TABLE t0000_nodes;--`,
`c TEXT); ALTER TABLE t0000_nodes ADD COLUMN pwned TEXT;--`,
`c TEXT); ATTACH DATABASE 'x.db' AS x;--`,
`c TEXT); UPDATE t0000_nodes SET data='';--`,
`name TEXT, evil TEXT`,
`field--comment`,
`field/*inline*/name`,
`field;DROP`,
`field)`,
`(field`,
`it''s`,
`a"b`,
"back`tick",
}
InjectionIdentifiers are crafted field/column-name payloads that attempt to break out of a SQL/DDL context. Each is something a caller could supply as an OQL JOIN field name (via a T-SQL delimited identifier) or a JSON-schema property key. A correct boundary rejects every one of these.
var PathTraversalDigests = []string{
"",
"a",
"ab",
"xyz",
"../../../etc/passwd",
"..",
"./.",
"foo/bar",
"AABBCCDD" + zeros(56),
"zz" + zeros(62),
zeros(63),
zeros(65),
zeros(64) + "/x",
}
PathTraversalDigests are blob-SHA payloads (D-004): values that are not a well-formed 64-char lowercase-hex digest and must be rejected before reaching the filesystem, including ones carrying path components.
var SQLMetacharacters = []string{
"'",
"\"",
"`",
")",
"(",
";",
"--",
"/*",
"*/",
}
SQLMetacharacters are the substrings that must never survive from an untrusted identifier into emitted SQL/DDL. A property test asserts that for any corpus identifier, either the boundary rejects it, or none of these appears in the generated SQL attributable to that identifier.
var ValidIdentifiers = []string{
"name",
"unit_cost",
"sku_code",
"field1",
"a",
"customer_id",
"line_total",
}
ValidIdentifiers are well-formed names that every identifier validator MUST accept. Property tests use these as the negative control: the boundary must not over-reject legitimate input.
Functions ¶
func AllIdentifierPayloads ¶
func AllIdentifierPayloads() []string
AllIdentifierPayloads concatenates the identifier-shaped corpora (everything except blob digests) for callers that want a single slice to iterate.
Types ¶
This section is empty.
Source Files