getcols.test.sas

Go to the documentation of this file.

/**
  @file
  @brief testing getcols service - input validation (security)
  @details The libds in the IWANT input table must be a well-formed
  LIBREF.DATASET.  An invalid value aborts the service before it
  reaches proc contents.  The abort shows up as a canceled child job
  (an aborted service registers no webout).
 
  The payload in test 1 resolves to a REAL table when the request
  content is executed as macro code, so on a vulnerable service the
  job completes, and only the validating service cancels it - the
  assertion cannot pass against a service that does not validate.
 
  <h4> SAS Macros </h4>
  @li mp_assert.sas
  @li mx_execute.sas
  @li mf_getuniquefileref.sas
 
**/
 
%let _program=&appLoc/services/public/getcols;
 
/**
  * Test 1 - macro content in libds must abort the service
  */
%let f1=%mf_getuniquefileref();
data _null_;
  file &f1 termstr=crlf;
  put 'LIBDS:$41.';
  put '%sysfunc(coalescec(&dclib..MPE_X_TEST,))';
run;
 
%mx_execute(&_program,
  viyacontext=&defaultcontext,
  inputfiles=&f1:iwant,
  outref=web1,
  viyaresult=WEBOUT_TXT
)
 
%let abort1=0;
data _null_;
  set work.results;
  if state='canceled' then call symputx('abort1',1);
run;
 
%mp_assert(
  iftrue=(&abort1=1),
  desc=Macro content in libds aborts the service,
  outds=work.test_results
)
 
/**
  * Test 2 - valid libds still returns columns
  */
%let f2=%mf_getuniquefileref();
data _null_;
  file &f2 termstr=crlf;
  put 'LIBDS:$41.';
  put "&dclib..MPE_X_TEST";
run;
 
%mx_execute(&_program,
  viyacontext=&defaultcontext,
  inputfiles=&f2:iwant,
  outlib=web2
)
 
%let nobs=0;
proc sql noprint;
select count(*) into: nobs from web2.cols;
quit;
 
%mp_assert(
  iftrue=(&nobs>0),
  desc=Valid libds returns columns,
  outds=work.test_results
)
 
/**
  * dump results to the log for offline inspection
  */
data _null_;
  set work.test_results;
  putlog 'TEST_RESULT_LINE: ' test_result ' - ' test_description;
run;