#NEWLINE# def test_sql_injection( ) : #NEWLINE# #INDENT# db = SQLAlchemy ( 'sqlite:///:memory:' ) #NEWLINE# auth = authcode . Auth ( SECRET_KEY , db = db , roles = True ) #NEWLINE# User = auth . User #NEWLINE# db . create_all ( ) #NEWLINE# user = User ( login = 'meh' , password = 'foobar' ) #NEWLINE# db . session . add ( user ) #NEWLINE# db . session . commit ( ) #NEWLINE# tests = [ "1'; DELETE FROM users" , '1"; DELETE FROM users' , "1' --" ] #NEWLINE# for passw in tests : #NEWLINE# #INDENT# user . set_raw_password ( passw ) #NEWLINE# db . session . commit ( ) #NEWLINE# assert ( user . password == passw )