sqli test case generator

[omursahin]

    /**
    * Calls:
    * 1 - (200) POST:/api/sqli/body/vulnerable
    * 2 - (200) POST:/api/sqli/body/vulnerable
    * Found 1 potential fault of type-code 200
    */
    @Test @Timeout(60)
    fun test_3_postOnVulnerableVulnerableToSQLInjection()  {
        
        
        // res_0_ms stores the start time in milliseconds
        val res_0_ms = System.currentTimeMillis()
        
        given().accept("*/*")
                .header("x-EMextraHeader123", "")
                .contentType("application/json")
                .body(" { " + 
                    " \"password\": \"_EM_107_XYZ_\", " + 
                    " \"username\": \"_EM_108_XYZ_\" " + 
                    " } ")
                .post("${baseUrlOfSut}/api/sqli/body/vulnerable?EMextraParam123=_EM_109_XYZ_")
                .then()
                .statusCode(200)
                .assertThat()
                .contentType("text/plain")
                .body(containsString("MATCHED: 0"))
        
        // res_2_ms stores the total execution time in milliseconds
        val res_2_ms = System.currentTimeMillis() - res_0_ms
        
        // Note: No SQL Injection vulnerability detected in this call. Expected response time (sqliBaselineMaxResponseTimeMs) should be less than 2000 ms.
        assertTrue(res_2_ms < 2000);
        
        
        // res_3_ms stores the start time in milliseconds
        val res_3_ms = System.currentTimeMillis()
        
        // Fault200. SQL Injection (SQLi). null.
        given().accept("*/*")
                .header("x-EMextraHeader123", "")
                .contentType("application/json")
                .body(" { " + 
                    " \"password\": \"_EM_2_XYZ_\u0027 OR (select pg_sleep(5.50)) IS NULL-- -\", " + 
                    " \"username\": \"_EM_3_XYZ_\u0027 OR (select pg_sleep(5.50)) IS NULL-- -\" " + 
                    " } ")
                .post("${baseUrlOfSut}/api/sqli/body/vulnerable?EMextraParam123=_EM_4_XYZ_%27+OR+%28select+pg_sleep%285.50%29%29+IS+NULL--+-")
                .then()
                .statusCode(200)
                .assertThat()
                .contentType("text/plain")
                .body(containsString("MATCHED: 0"))
        
        // res_5_ms stores the total execution time in milliseconds
        val res_5_ms = System.currentTimeMillis() - res_3_ms
        
        // Note: SQL Injection vulnerability detected in this call. Expected response time (sqliInjectedSleepDurationMs) should be greater than 5500 ms.
        assertTrue(res_5_ms > 5500);
    }

[arcuri82]

we need 1 E2E under core-tests/e2e-tests/spring/spring-rest-bb to make sure the generation of tests works fine for all test output formats

[arcuri82]

we need to add comment to specify why we do this... ie cannot currently run real database due to Docker issues on OS in GitHub action. but, can leave TODO stating we could update/replace it one day if can safely run Docker on GA

[arcuri82]

these classes are not used... can leave a TODO comment stating might be needed if one day can run BB tests with Docker on GitHub Actions