mirror of
https://github.com/inspec/inspec
synced 2024-11-15 01:17:08 +00:00
33 lines
941 B
Ruby
33 lines
941 B
Ruby
# encoding: utf-8
|
|
# author: Christoph Hartmann
|
|
# author: Dominik Richter
|
|
|
|
module Inspec::Resources
|
|
class MssqlSession < Inspec.resource(1)
|
|
name 'mssql_session'
|
|
desc 'Use the mssql_session InSpec audit resource to test SQL commands run against a MS Sql Server database.'
|
|
example "
|
|
sql = mssql_session('myuser','mypassword')
|
|
describe sql.query('select * from sys.databases where name like \'*test*\') do
|
|
its('stdout') {should_not match(/test/) }
|
|
end
|
|
"
|
|
|
|
def initialize(user = nil, pass = nil)
|
|
@user = user
|
|
@pass = pass
|
|
skip_resource('user and pass are required for MSSQL tests') if @user.nil? or @pass.nil?
|
|
end
|
|
|
|
def query(q)
|
|
escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"').gsub(/\$/, '\\$').gsub(/\@/, '`@')
|
|
cmd = inspec.command("sqlcmd -U #{@user} -P #{@pass} -Q \"#{escaped_query}\"")
|
|
|
|
cmd
|
|
end
|
|
|
|
def to_s
|
|
'MSSQL'
|
|
end
|
|
end
|
|
end
|