Coverage for tests / integration / test_injection_vulnerabilities_api.py: 0%

1"""Integration tests for the injection-vulnerabilities-api. 

2 

3Verifies that GraphQLer's injection detectors correctly flag the intentionally 

4vulnerable endpoints exposed by tests/test-apis/injection-vulnerabilities-api/. 

5 

6Detectors exercised: 

7 - SQL Injection (searchPosts — raw string interpolated into SQLite query) 

8 - XSS Injection (createPost / getPost — content reflected verbatim) 

9 - Path Injection (readFile — path traversal to /etc/passwd) 

10 - OS Command Injection (executeCommand — shell passthrough) 

11""" 

12 

13import os 

14import shutil 

15import unittest 

16 

17from graphqler import __main__, config 

18from tests.integration.utils.run_api import run_node_project, wait_for_server 

19from tests.integration.utils.stats import ( 

20 get_vulnerabilities_from_stats, 

21 is_detection_flagged, 

22) 

23 

24 

25class TestInjectionVulnerabilitiesAPI(unittest.TestCase): 

26 PORT = 4002 

27 URL = f"http://localhost:{PORT}/graphql" 

28 PATH = "ci-test-injection-vulnerabilities-api/" 

29 API_PATH = "tests/test-apis/injection-vulnerabilities-api" 

30 CONFIG_PATH = "tests/test-apis/test_configs/injection_vulnerabilities_api_config.toml" 

31 process = None 

32 process_pid = None 

33 

34 @classmethod 

35 def setUpClass(cls): 

36 cls.process = run_node_project(cls.API_PATH, [], str(cls.PORT)) 

37 cls.process_pid = cls.process.pid 

38 

39 parsed = __main__.parse_config(cls.CONFIG_PATH) 

40 __main__.set_config(parsed) 

41 

42 wait_for_server(cls.URL, timeout=30) 

43 

44 @classmethod 

45 def tearDownClass(cls): 

46 if cls.process and cls.process.pid == cls.process_pid: 

47 cls.process.kill() 

48 cls.process.wait() 

49 if os.path.exists(cls.PATH): 

50 shutil.rmtree(cls.PATH) 

51 

52 # ── Compilation ────────────────────────────────────────────────────────── 

53 

54 def test_compile_generates_introspection_file(self): 

55 __main__.run_compile_mode(self.PATH, self.URL) 

56 introspection_path = os.path.join(self.PATH, config.INTROSPECTION_RESULT_FILE_NAME) 

57 self.assertTrue(os.path.exists(introspection_path)) 

58 self.assertGreater(os.path.getsize(introspection_path), 0) 

59 

60 # ── Fuzzing ────────────────────────────────────────────────────────────── 

61 

62 def test_fuzz_generates_stats_file(self): 

63 __main__.run_compile_mode(self.PATH, self.URL) 

64 __main__.run_fuzz_mode(self.PATH, self.URL) 

65 stats_path = os.path.join(self.PATH, config.STATS_FILE_NAME) 

66 self.assertTrue(os.path.exists(stats_path)) 

67 self.assertGreater(os.path.getsize(stats_path), 0) 

68 

69 def test_fuzz_generates_json_stats_file(self): 

70 __main__.run_compile_mode(self.PATH, self.URL) 

71 __main__.run_fuzz_mode(self.PATH, self.URL) 

72 json_path = os.path.join(self.PATH, "stats.json") 

73 self.assertTrue(os.path.exists(json_path)) 

74 self.assertGreater(os.path.getsize(json_path), 0) 

75 

76 # ── Injection detection ─────────────────────────────────────────────────── 

77 

78 def _run_and_get_vulns(self): 

79 __main__.run_compile_mode(self.PATH, self.URL) 

80 __main__.run_fuzz_mode(self.PATH, self.URL) 

81 return get_vulnerabilities_from_stats(self.PATH) 

82 

83 def test_sql_injection_detected(self): 

84 vulns = self._run_and_get_vulns() 

85 self.assertTrue( 

86 is_detection_flagged(vulns, "SQL Injection (SQLi) Injection"), 

87 f"Expected SQL injection to be flagged. Got: {vulns}", 

88 ) 

89 

90 def test_xss_injection_detected(self): 

91 vulns = self._run_and_get_vulns() 

92 self.assertTrue( 

93 is_detection_flagged(vulns, "Cross-Site Scripting (XSS) Injection"), 

94 f"Expected XSS to be flagged. Got: {vulns}", 

95 ) 

96 

97 def test_path_injection_detected(self): 

98 vulns = self._run_and_get_vulns() 

99 self.assertTrue( 

100 is_detection_flagged(vulns, "Path Injection"), 

101 f"Expected path injection to be flagged. Got: {vulns}", 

102 ) 

103 

104 def test_os_command_injection_detected(self): 

105 vulns = self._run_and_get_vulns() 

106 self.assertTrue( 

107 is_detection_flagged(vulns, "OS Command Injection"), 

108 f"Expected OS command injection to be flagged. Got: {vulns}", 

109 )