function ConditionTest::testCompileWithSqlInjectionForOperator

Tests compile with sql injection for operator.

Attributes

File

core/tests/Drupal/Tests/Core/Database/ConditionTest.php, line 186

Class

ConditionTest

Tests Drupal\Core\Database\Query\Condition.

Namespace

Code

public function testCompileWithSqlInjectionForOperator($operator) : void {
  $connection = $this->createStub(Connection::class);
  $connection->method('escapeField')
    ->willReturnCallback(function (string $field) : string|array|null {
    return preg_replace('/[^A-Za-z0-9_.]+/', '', $field);
  });
  $connection->method('mapConditionOperator')
    ->willReturn(NULL);
  $connection->method('condition')
    ->willReturn(new Condition('AND'));
  $query_placeholder = $this->prophesize(PlaceholderInterface::class);
  $counter = 0;
  $query_placeholder->nextPlaceholder()
    ->will(function () use (&$counter) : int {
    return $counter++;
  });
  $query_placeholder->uniqueIdentifier()
    ->willReturn(4);
  $query_placeholder = $query_placeholder->reveal();
  $condition = $connection->condition('AND');
  $condition->condition('name', 'value', $operator);
  $this->expectException(InvalidQueryException::class);
  $this->expectExceptionMessageIsOrContains('Invalid characters in query operator:');
  $condition->compile($connection, $query_placeholder);
}