Examples with UpdateRequest org.apache.jena.update.UpdateRequest used on opensource projects

Example 76 with UpdateRequest

use of org.apache.jena.update.UpdateRequest in project jena by apache.

the class TestParameterizedSparqlString method test_param_string_injection_02.

@Test(expected = ARQException.class)
public void test_param_string_injection_02() {
    // This injection is prevented by forbidding the > character in URIs
    String str = "PREFIX : <http://example/>\nINSERT DATA { <s> <p> ?var2 . }";
    ParameterizedSparqlString pss = new ParameterizedSparqlString(str);
    pss.setIri("var2", "hello> } ; DROP ALL ; INSERT DATA { <s> <p> <goodbye");
    UpdateRequest updates = pss.asUpdate();
    Assert.fail("Attempt to do SPARQL injection should result in an exception");
}

Example 77 with UpdateRequest

use of org.apache.jena.update.UpdateRequest in project jena by apache.

the class TestServerReadOnly method update_readonly.

@Test()
public void update_readonly() {
    FusekiTest.exec404(() -> {
        UpdateRequest update = UpdateFactory.create("INSERT DATA {}");
        UpdateProcessor proc = UpdateExecutionFactory.createRemote(update, serviceUpdate());
        proc.execute();
    });
}

Example 78 with UpdateRequest

use of org.apache.jena.update.UpdateRequest in project jena by apache.

the class TestParameterizedSparqlString method test_param_string_injection_08.

@Test(expected = ARQException.class)
public void test_param_string_injection_08() {
    // This injection attempt results in an invalid SPARQL update because
    // you end up with a double quoted literal inside a single quoted
    // literal
    String str = "PREFIX : <http://example/>\nINSERT DATA { <s> <p> '?var' }";
    ParameterizedSparqlString pss = new ParameterizedSparqlString(str);
    pss.setLiteral("var", "' . } ; DROP ALL ; INSERT DATA { <s> <p> <o> }#");
    UpdateRequest updates = pss.asUpdate();
    Assert.fail("Attempt to do SPARQL injection should result in an exception");
}

Example 79 with UpdateRequest

use of org.apache.jena.update.UpdateRequest in project jena by apache.

the class TestParameterizedSparqlString method test_param_string_positional_injection_11.

@Test(expected = ARQException.class)
public void test_param_string_positional_injection_11() {
    // This is a variant on placing a variable bound to a literal inside a
    // literal resulting in an injection, we are now able to detect and
    // prevent this
    String str = "PREFIX : <http://example/>\nINSERT DATA { <s> <p> \" ? \" }";
    ParameterizedSparqlString pss = new ParameterizedSparqlString(str);
    pss.setLiteral(0, " . } ; DROP ALL ; INSERT DATA { <s> <p> ");
    UpdateRequest updates = pss.asUpdate();
    Assert.fail("Attempt to do SPARQL injection should result in an exception");
}

Example 80 with UpdateRequest

use of org.apache.jena.update.UpdateRequest in project jena by apache.

the class TestParameterizedSparqlString method test_param_string_injection_01.

@Test(expected = ARQException.class)
public void test_param_string_injection_01() {
    // This injection is prevented by forbidding the > character in URIs
    String str = "PREFIX : <http://example/>\nINSERT DATA { <s> <p> ?var2 . }";
    ParameterizedSparqlString pss = new ParameterizedSparqlString(str);
    pss.setIri("var2", "hello> } ; DROP ALL ; INSERT DATA { <s> <p> <goodbye>");
    UpdateRequest updates = pss.asUpdate();
    Assert.fail("Attempt to do SPARQL injection should result in an exception");
}