freefire
d784b0ea7a
站点/后台分轨背景与用户列表排序一并落地；生产 CORS 改走 SITE_URL，健康检查带版本号。 Co-authored-by: Cursor <cursoragent@cursor.com>
47 lines
1.4 KiB
Go
47 lines
1.4 KiB
Go
package service
|
||
|
||
import (
|
||
"strings"
|
||
"testing"
|
||
|
||
"github.com/freefire/jiang13-bbs/model"
|
||
)
|
||
|
||
func TestAdminUserOrderSQLDefault(t *testing.T) {
|
||
got := adminUserOrderSQL("", "")
|
||
if got != "users.id DESC" {
|
||
t.Fatalf("默认排序应为 id DESC，得到 %q", got)
|
||
}
|
||
if adminUserOrderSQL("unknown", "drop table") != "users.id DESC" {
|
||
t.Fatalf("非法 sort/dir 必须回落到 id DESC")
|
||
}
|
||
}
|
||
|
||
func TestAdminUserOrderSQLWhitelist(t *testing.T) {
|
||
cases := []struct {
|
||
sort, dir, wantSub string
|
||
asc bool
|
||
}{
|
||
{"id", "asc", "users.id ASC", true},
|
||
{"points", "desc", "users.points DESC, users.id DESC", false},
|
||
{"status", "ASC", "users.banned ASC, users.id DESC", true},
|
||
{"created_at", "", "users.created_at DESC, users.id DESC", false},
|
||
{"online", "asc", "users.last_seen_at ASC NULLS LAST", true},
|
||
{"last_login", "desc", "FROM login_logs", false},
|
||
{"role", "asc", "WHEN 'owner' THEN 100", true},
|
||
{"counts", "desc", "posts.status = '" + model.ContentStatusPublished + "'", false},
|
||
}
|
||
for _, tc := range cases {
|
||
got := adminUserOrderSQL(tc.sort, tc.dir)
|
||
if !strings.Contains(got, tc.wantSub) {
|
||
t.Fatalf("sort=%s dir=%s 应包含 %q，得到 %q", tc.sort, tc.dir, tc.wantSub, got)
|
||
}
|
||
if strings.ContainsAny(tc.sort+tc.dir, ";") {
|
||
t.Fatalf("用例本身不应含注入字符")
|
||
}
|
||
if tc.asc && !strings.Contains(got, "ASC") {
|
||
t.Fatalf("sort=%s 应为 ASC：%q", tc.sort, got)
|
||
}
|
||
}
|
||
}
|