Samir Boulahtit
4cb4fec8e2
- Fix middleware fixtures: vendor_code instead of code, add owner_user_id to company
- Fix performance tests: MarketplaceProduct uses translations for title/description
- Fix security tests: use correct API endpoints (/api/v1/admin/*, /api/v1/vendor/*)
- Fix workflow tests: use actual admin API endpoints
- Fix background task tests: remove invalid vendor_name field, add language
Note: Many middleware integration tests still fail due to dynamic routes
being caught by the /{slug} catch-all route. These tests need further
refactoring to use /api/* prefixed routes.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
59 lines
2.0 KiB
Python
59 lines
2.0 KiB
Python
# tests/integration/security/test_input_validation.py
|
|
"""
|
|
Input validation tests for the API.
|
|
|
|
Tests SQL injection prevention, parameter validation, and JSON validation.
|
|
"""
|
|
import pytest
|
|
|
|
|
|
@pytest.mark.integration
|
|
@pytest.mark.security
|
|
class TestInputValidation:
|
|
def test_sql_injection_prevention(self, client, admin_headers):
|
|
"""Test SQL injection prevention in search parameters"""
|
|
# Try SQL injection in search parameter
|
|
malicious_search = "'; DROP TABLE products; --"
|
|
|
|
response = client.get(
|
|
f"/api/v1/admin/products?search={malicious_search}",
|
|
headers=admin_headers,
|
|
)
|
|
|
|
# Should not crash and should return normal response
|
|
assert response.status_code == 200
|
|
# Database should still be intact (no products dropped)
|
|
|
|
def test_parameter_validation(self, client, admin_headers):
|
|
"""Test parameter validation for API endpoints"""
|
|
# Test invalid pagination parameters
|
|
response = client.get(
|
|
"/api/v1/admin/products?limit=-1", headers=admin_headers
|
|
)
|
|
assert response.status_code == 422 # Validation error
|
|
|
|
response = client.get(
|
|
"/api/v1/admin/products?skip=-1", headers=admin_headers
|
|
)
|
|
assert response.status_code == 422 # Validation error
|
|
|
|
def test_json_validation(self, client, admin_headers, test_company):
|
|
"""Test JSON validation for POST requests"""
|
|
# Test invalid JSON structure
|
|
response = client.post(
|
|
"/api/v1/admin/vendors",
|
|
headers=admin_headers,
|
|
content="invalid json content",
|
|
)
|
|
assert response.status_code == 422 # JSON decode error
|
|
|
|
# Test missing required fields
|
|
response = client.post(
|
|
"/api/v1/admin/vendors",
|
|
headers=admin_headers,
|
|
json={
|
|
"name": "Test Vendor"
|
|
}, # Missing required company_id, vendor_code
|
|
)
|
|
assert response.status_code == 422 # Validation error
|