validatefilter.test.1.sas

Go to the documentation of this file.

/**
  @file
  @brief testing validatefilter service - input validation (security)
  @details The filter_table in the IWANT input table must be a
  well-formed LIBREF.DATASET.  An invalid value aborts the service
  before it reaches mp_filterstore.  The abort shows up as a canceled
  child job (an aborted service registers no webout).
 
  The payload in test 1 resolves to a REAL table when the request
  content is executed as macro code, so on a vulnerable service the
  job completes, and only the validating service cancels it - the
  assertion cannot pass against a service that does not validate.
 
  <h4> SAS Macros </h4>
  @li mp_assert.sas
  @li mx_execute.sas
  @li mf_getuniquefileref.sas
 
**/
 
%let _program=&appLoc/services/public/validatefilter;
 
/**
  * Test 1 - macro content in filter_table must abort the service
  */
%let f1=%mf_getuniquefileref();
data _null_;
  file &f1 termstr=crlf;
  put 'FILTER_TABLE:$41.';
  put '%sysfunc(coalescec(&dclib..MPE_TABLES,))';
run;
 
%mx_execute(&_program,
  viyacontext=&defaultcontext,
  inputfiles=&f1:iwant,
  outref=web1,
  viyaresult=WEBOUT_TXT
)
 
%let abort1=0;
data _null_;
  set work.results;
  if state='canceled' then call symputx('abort1',1);
run;
 
%mp_assert(
  iftrue=(&abort1=1),
  desc=Macro content in filter_table aborts the service,
  outds=work.test_results
)
 
/**
  * Test 2 - valid filter_table still stores a filter
  */
%let f2=%mf_getuniquefileref();
data _null_;
  file &f2 termstr=crlf;
  put 'FILTER_TABLE:$41.';
  put "&dclib..MPE_TABLES";
run;
%let f3=%mf_getuniquefileref();
data _null_;
  file &f3 termstr=crlf;
  infile datalines4 dsd;
  input;
  put _infile_;
datalines4;
GROUP_LOGIC:$3. SUBGROUP_LOGIC:$3. SUBGROUP_ID:8. VARIABLE_NM:$32. OPERATOR_NM:$10. RAW_VALUE:$4000.
AND,AND,1,LIBREF,CONTAINS,"'DC'"
AND,OR,2,DSN,=,"'MPE_LOCK_ANYTABLE'"
;;;;
run;
 
%mx_execute(&_program,
  viyacontext=&defaultcontext,
  inputfiles=&f2:iwant &f3:filterquery,
  outlib=web2
)
 
%let nobs=0;
proc sql noprint;
select count(*) into: nobs from web2.result;
quit;
 
%mp_assert(
  iftrue=(&nobs>0),
  desc=Valid filter_table returns a filter result,
  outds=work.test_results
)
 
/**
  * dump results to the log for offline inspection
  */
data _null_;
  set work.test_results;
  putlog 'TEST_RESULT_LINE: ' test_result ' - ' test_description;
run;