Demo :: TDD with Security

sql_injection.java

@Test
public void attack_with_sql_injection_to_table_person_should_return_all_data() {
	PersonDAO personDAO = new PersonDAO(getDataSource());
	List<Person> persons = personDAO.getPerson("'or '1'='1");

	assertEquals(5, persons.size());
}

sql_injection2.java

@Test(expected = DataNotFoundException.class)
public void attack_with_sql_injection_to_table_person_should_return_data_not_found() {
	PersonDAO personDAO = new PersonDAO(getDataSource());
	personDAO.getPerson("'or '1'='1");
}