@@ -71,31 +71,27 @@ func Test_Model_Update_EmptyData(t *testing.T) {
7171 })
7272}
7373
74- // Test_Model_Update_NoWhere tests Update without WHERE clause
74+ // Test_Model_Update_NoWhere tests Update without WHERE clause is rejected by framework
7575func Test_Model_Update_NoWhere (t * testing.T ) {
7676 table := createInitTable ()
7777 defer dropTable (table )
7878
7979 gtest .C (t , func (t * gtest.T ) {
80- // Update all records without WHERE should work but is risky
81- result , err := db .Model (table ).Data (g.Map {"nickname" : "updated" }).Update ()
82- t .AssertNil (err )
83- n , _ := result .RowsAffected ()
84- t .Assert (n , TableSize )
80+ // Framework safety check: Update without WHERE should return error
81+ _ , err := db .Model (table ).Data (g.Map {"nickname" : "updated" }).Update ()
82+ t .AssertNE (err , nil )
8583 })
8684}
8785
88- // Test_Model_Delete_NoWhere tests Delete without WHERE clause
86+ // Test_Model_Delete_NoWhere tests Delete without WHERE clause is rejected by framework
8987func Test_Model_Delete_NoWhere (t * testing.T ) {
9088 table := createInitTable ()
9189 defer dropTable (table )
9290
9391 gtest .C (t , func (t * gtest.T ) {
94- // Delete all records without WHERE should work
95- result , err := db .Model (table ).Delete ()
96- t .AssertNil (err )
97- n , _ := result .RowsAffected ()
98- t .Assert (n , TableSize )
92+ // Framework safety check: Delete without WHERE should return error
93+ _ , err := db .Model (table ).Delete ()
94+ t .AssertNE (err , nil )
9995 })
10096}
10197
@@ -131,11 +127,19 @@ func Test_Model_Scan_EmptyResult(t *testing.T) {
131127 Id int
132128 }
133129
130+ // Scan initialized struct with empty result returns sql.ErrNoRows
134131 gtest .C (t , func (t * gtest.T ) {
135132 var user User
136133 err := db .Model (table ).Where ("id > ?" , 1000 ).Scan (& user )
134+ t .AssertNE (err , nil )
135+ })
136+
137+ // Scan nil pointer with empty result returns nil error
138+ gtest .C (t , func (t * gtest.T ) {
139+ var user * User
140+ err := db .Model (table ).Where ("id > ?" , 1000 ).Scan (& user )
137141 t .AssertNil (err )
138- t .Assert (user . Id , 0 ) // Should be zero value
142+ t .Assert (user , nil )
139143 })
140144}
141145
@@ -184,7 +188,7 @@ func Test_Model_Fields_Empty(t *testing.T) {
184188 gtest .C (t , func (t * gtest.T ) {
185189 result , err := db .Model (table ).Fields ("" ).Limit (1 ).All ()
186190 t .AssertNil (err )
187- t .Assert (len (result ) <= 1 )
191+ t .AssertLE (len (result ), 1 )
188192 })
189193}
190194
@@ -200,8 +204,8 @@ func Test_Model_Order_InvalidSyntax(t *testing.T) {
200204 })
201205}
202206
203- // Test_Model_Group_InvalidSyntax tests Group with invalid syntax
204- func Test_Model_Group_InvalidSyntax (t * testing.T ) {
207+ // Test_Model_Group_UnknownColumn tests Group with non-existent column
208+ func Test_Model_Group_UnknownColumn (t * testing.T ) {
205209 table := createInitTable ()
206210 defer dropTable (table )
207211
@@ -234,17 +238,20 @@ func Test_Model_SQLInjection_Where(t *testing.T) {
234238 defer dropTable (table )
235239
236240 gtest .C (t , func (t * gtest.T ) {
237- // Attempt SQL injection through parameter
241+ // Attempt SQL injection through string column parameter.
242+ // Using string column `nickname` instead of int column `id`,
243+ // because MySQL coerces "1 OR 1=1" to 1 for int columns.
238244 maliciousInput := "1 OR 1=1"
239- result , err := db .Model (table ).Where ("id = ?" , maliciousInput ).All ()
245+ result , err := db .Model (table ).Where ("nickname = ?" , maliciousInput ).All ()
240246 t .AssertNil (err )
241247 t .Assert (len (result ), 0 ) // Should not return all records
242248 })
243249
244250 gtest .C (t , func (t * gtest.T ) {
245- // Attempt SQL injection with quotes
251+ // Attempt SQL injection with quotes, using string column to avoid
252+ // MySQL implicit int conversion (which would coerce "1'..." to 1)
246253 maliciousInput := "1'; DROP TABLE " + table + "; --"
247- result , err := db .Model (table ).Where ("id = ?" , maliciousInput ).All ()
254+ result , err := db .Model (table ).Where ("nickname = ?" , maliciousInput ).All ()
248255 t .AssertNil (err )
249256 t .Assert (len (result ), 0 )
250257 // Table should still exist
0 commit comments