Example query to use to test for cypher injection?

user_10917765 0
Viewed 344

I'm new to neo4j and have been tasked with writing some cypher injection tests. We are using parameterization but i'm writing tests in case someone changed it to use string concat. I need an example query to check for in my tests but I'm not completely sure what would be a good one. I was thinking of using MATCH (n) DETACH DELETE n for deleting all nodes and relationships but I wasn't sure if I needed to add a quote at the beginning or something so that it would end the string and run the query? As in "MATCH (n) DETACH DELETE n. Would that work or is there something better I could use? Thanks for any help!

cypher neo4j testing
1 Answers

This query is different from what you asked:

These are two ways to get user:

  1. String concatenation:

"MATCH (u:USER) WHERE u.id = " + id + " RETURN u"

  1. Parametrized:

"MATCH (u:USER) WHERE u.id = {id} RETURN u"

You can check by passing the value of id in both queries like:

1 OR 1=1

Or worst value for id like:

1 OR 1=1
WITH u
DETACH DELETE u

user_60779140
Related