tests

Author: mtrezza

spec/vulnerabilities.spec.js

@@ -1380,6 +1380,51 @@ describe('(GHSA-gqpp-xgvh-9h7h) SQL Injection via dot-notation sub-key name in I
     expect(elapsed).toBeLessThan(3000);
   });
 
+  it_only_db('postgres')('does not execute injected SQL via double quote in sub-key name', async () => {
+    const obj = new Parse.Object('SubKeyTest');
+    obj.set('stats', { counter: 0 });
+    await obj.save();
+
+    const start = Date.now();
+    await request({
+      method: 'PUT',
+      url: `http://localhost:8378/1/classes/SubKeyTest/${obj.id}`,
+      headers,
+      body: JSON.stringify({
+        'stats.x" || (SELECT pg_sleep(3))::text || "': { __op: 'Increment', amount: 1 },
+      }),
+    }).catch(() => {});
+    const elapsed = Date.now() - start;
+
+    // Double quotes break JSON structure inside the CONCAT, producing invalid JSONB.
+    // This causes a database error, NOT SQL injection. If injection succeeded,
+    // the query would take >= 3 seconds due to pg_sleep.
+    expect(elapsed).toBeLessThan(3000);
+  });
+
+  it_only_db('postgres')('does not execute injected SQL via double quote crafted as valid JSONB in sub-key name', async () => {
+    const obj = new Parse.Object('SubKeyTest');
+    obj.set('stats', { counter: 0 });
+    await obj.save();
+
+    // This payload uses double quotes to craft a sub-key that produces valid JSONB
+    // (e.g. '{"x":0,"evil":1}') instead of breaking JSON structure. Even so, both
+    // interpolation sites are inside single-quoted SQL strings, so double quotes
+    // cannot escape the SQL context — no arbitrary SQL execution is possible.
+    const start = Date.now();
+    await request({
+      method: 'PUT',
+      url: `http://localhost:8378/1/classes/SubKeyTest/${obj.id}`,
+      headers,
+      body: JSON.stringify({
+        'stats.x":0,"pg_sleep(3)': { __op: 'Increment', amount: 1 },
+      }),
+    }).catch(() => {});
+    const elapsed = Date.now() - start;
+
+    expect(elapsed).toBeLessThan(3000);
+  });
+
   it_only_db('postgres')('allows valid Increment on nested object field with normal sub-key', async () => {
     const obj = new Parse.Object('SubKeyTest');
     obj.set('stats', { counter: 5 });