getcolvals.test.4.sas

Go to the documentation of this file.

/**
  @file
  @brief testing getcolvals service - input validation (security)
  @details The libds and col in the IWANT input table must be
  well-formed (LIBREF.DATASET and SAS name).  An invalid value aborts
  the service, which shows up as a canceled child job (an aborted
  service registers no webout).
 
  The payloads in tests 1-2 resolve to a REAL table / column when the
  request content is executed as macro code, so on a vulnerable
  service the job completes, and only the validating service cancels
  it - the assertion cannot pass against a service that does not
  validate.
 
  <h4> SAS Macros </h4>
  @li mp_assert.sas
  @li mx_execute.sas
  @li mf_getuniquefileref.sas
 
**/
 
%let _program=&appLoc/services/public/getcolvals;
 
/**
  * Test 1 - macro content in libds must abort the service
  */
%let f1=%mf_getuniquefileref();
data _null_;
  file &f1 termstr=crlf;
  put 'LIBDS:$19. COL:$9.';
  put '%sysfunc(coalescec(&dclib..MPE_X_TEST,)),SOME_TIME';
run;
 
%mx_execute(&_program,
  viyacontext=&defaultcontext,
  inputfiles=&f1:iwant,
  outref=web1,
  viyaresult=WEBOUT_TXT
)
 
%let abort1=0;
data _null_;
  set work.results;
  if state='canceled' then call symputx('abort1',1);
run;
 
%mp_assert(
  iftrue=(&abort1=1),
  desc=Macro content in libds aborts the service,
  outds=work.test_results
)
 
/**
  * Test 2 - macro content in col must abort the service
  */
%let f2=%mf_getuniquefileref();
data _null_;
  file &f2 termstr=crlf;
  put 'LIBDS:$19. COL:$9.';
  put '&dclib..MPE_X_TEST,%sysfunc(coalescec(SOME_TIME,))';
run;
 
%mx_execute(&_program,
  viyacontext=&defaultcontext,
  inputfiles=&f2:iwant,
  outref=web2,
  viyaresult=WEBOUT_TXT
)
 
%let abort2=0;
data _null_;
  set work.results;
  if state='canceled' then call symputx('abort2',1);
run;
 
%mp_assert(
  iftrue=(&abort2=1),
  desc=Macro content in col aborts the service,
  outds=work.test_results
)
 
/**
  * Test 3 - valid inputs still return values
  */
%let f3=%mf_getuniquefileref();
data _null_;
  file &f3 termstr=crlf;
  put 'LIBDS:$19. COL:$9.';
  put "&dclib..MPE_X_TEST,SOME_TIME";
run;
 
%mx_execute(&_program,
  viyacontext=&defaultcontext,
  inputfiles=&f3:iwant,
  outlib=web3
)
 
%let nobs=0;
proc sql noprint;
select count(*) into: nobs from web3.vals;
quit;
 
%mp_assert(
  iftrue=(&nobs>0),
  desc=Valid inputs return values,
  outds=work.test_results
)
 
/**
  * dump results to the log for offline inspection
  */
data _null_;
  set work.test_results;
  putlog 'TEST_RESULT_LINE: ' test_result ' - ' test_description;
run;