testing getdiffs service - input validation (security) More...

Detailed Description

The libds, table and stp_diffs_csv request params must be well-formed before they reach the access check and the staging file path. An invalid value aborts the service, which shows up as a canceled child job (an aborted service registers no webout).

A real load is staged first (stagedata) and a diffs csv written into the staging directory, so every payload below resolves to that REAL file when executed - on a vulnerable service the job completes, and only the validating service cancels it. The assertions cannot pass against a service that does not validate.

SAS Macros

Definition in file getdiffs.test.sas.