getrawdata.test.1.sas

Go to the documentation of this file.

/**
  @file
  @brief testing getrawdata service - input validation (security)
  @details table must be a well-formed LIBREF.DATASET (the trailing
  format-catalog suffix is permitted), filter must be an integer and
  type one of the supported download types.  An invalid value aborts
  the service before any request content can execute.  The abort is
  asserted from the child job state: the payloads either resolve to a
  real table when executed as macro code, or write a file outside the
  WORK directory (verified by live probe) - so on the vulnerable
  service the job completes, and only the validating service cancels
  it.  The assertion cannot pass against a service that does not
  validate.
 
  <h4> SAS Macros </h4>
  @li mp_assert.sas
  @li mx_execute.sas
 
**/
 
%let _program=&appLoc/services/public/getrawdata;
 
/**
  * Test 1 - macro content in table must abort the service
  * (the payload resolves to a real table when executed as macro code)
  */
data work.params1;
  length name $32 value $1000;
  name='type';value='CSV';output;
  name='table';value='%sysfunc(coalescec(&mpelib..MPE_X_TEST,))';output;
  name='filter';value='0';output;
run;
 
%mx_execute(&_program,
  viyacontext=&defaultcontext,
  inputparams=work.params1,
  outref=web1,
  viyaresult=WEBOUT_TXT
)
 
%let abort1=0;
data _null_;
  set work.results;
  if state='canceled' then call symputx('abort1',1);
run;
 
%mp_assert(
  iftrue=(&abort1=1),
  desc=Macro content in table aborts the service,
  outds=work.test_results
)
 
/**
  * Test 2 - sql injection in filter must abort the service
  */
data work.params2;
  length name $32 value $1000;
  name='type';value='CSV';output;
  name='table';value="&dclib..MPE_X_TEST";output;
  name='filter';value='0 or 1=1';output;
run;
 
%mx_execute(&_program,
  viyacontext=&defaultcontext,
  inputparams=work.params2,
  outref=web2,
  viyaresult=WEBOUT_TXT
)
 
%let abort2=0;
data _null_;
  set work.results;
  if state='canceled' then call symputx('abort2',1);
run;
 
%mp_assert(
  iftrue=(&abort2=1),
  desc=SQL injection in filter aborts the service,
  outds=work.test_results
)
 
/**
  * Test 3 - path traversal in table must abort the service
  * (verified by live probe: on a vulnerable service this writes
  * ../SECPROBE.csv outside the WORK directory and completes)
  */
data work.params3;
  length name $32 value $1000;
  name='type';value='CSV';output;
  name='table';value='../secprobe';output;
  name='filter';value='0';output;
run;
 
%mx_execute(&_program,
  viyacontext=&defaultcontext,
  inputparams=work.params3,
  outref=web3,
  viyaresult=WEBOUT_TXT
)
 
%let abort3=0;
data _null_;
  set work.results;
  if state='canceled' then call symputx('abort3',1);
run;
 
%mp_assert(
  iftrue=(&abort3=1),
  desc=Path traversal in table aborts the service,
  outds=work.test_results
)
 
/**
  * Test 4 - the valid request must still work (positive control)
  */
data work.params4;
  length name $32 value $1000;
  name='type';value='CSV';output;
  name='table';value="&dclib..MPE_X_TEST";output;
  name='filter';value='0';output;
run;
 
%mx_execute(&_program,
  viyacontext=&defaultcontext,
  inputparams=work.params4,
  outref=web4,
  viyaresult=WEBOUT_TXT
)
 
%let ok4=0;
data _null_;
  infile web4;
  input;
  if _infile_=:'PRIMARY_KEY_FIELD' then do;
    call symputx('ok4',1);
    stop;
  end;
run;
 
%mp_assert(
  iftrue=(&ok4=1),
  desc=Valid table request still returns data,
  outds=work.test_results
)
 
/**
  * dump results to the log for offline inspection
  */
data _null_;
  set work.test_results;
  putlog 'TEST_RESULT_LINE: ' test_result ' - ' test_description;
run;