team-alpha/railsgoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

appease our new robot overlords.

Browse Source 
(I voted for Krang)
This commit is contained in:
Joseph Mastey
2017-12-12 21:00:45 -06:00
parent 4587a5ff67
commit bb863f5156
9 changed files with 34 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spec/vulnerabilities/sql_injection_spec.rb
+5 -5
View File
@@ -16,13 +16,13 @@ feature "sql injection" do
visit "/users/#{@normal_user.id}/account_settings"
within('#account_edit') do
fill_in 'Email', :with => 'joe.admin@schmoe.com'
fill_in 'user_password', :with => 'H4cketyhack'
fill_in 'user_password_confirmation', :with => 'H4cketyhack'
within("#account_edit") do
fill_in "Email", with: "joe.admin@schmoe.com"
fill_in "user_password", with: "H4cketyhack"
fill_in "user_password_confirmation", with: "H4cketyhack"
# this is a hidden field, so cannot use fill_in to access it.
find(:xpath, "//input[@id='user_id']", :visible => false).set "8' OR admin='t') --"
find(:xpath, "//input[@id='user_id']", visible: false).set "8' OR admin='t') --"
end
click_on "Submit"