getcolvals.test.4.sas File Reference

testing getcolvals service - input validation (security) More...

Go to the source code of this file.

Detailed Description

The libds and col in the IWANT input table must be well-formed (LIBREF.DATASET and SAS name). An invalid value aborts the service, which shows up as a canceled child job (an aborted service registers no webout).

The payloads in tests 1-2 resolve to a REAL table / column when the request content is executed as macro code, so on a vulnerable service the job completes, and only the validating service cancels it - the assertion cannot pass against a service that does not validate.

SAS Macros

• mp_assert.sas
• mx_execute.sas
• mf_getuniquefileref.sas

Definition in file getcolvals.test.4.sas.