AI ile Test ve Güvenlik — Yeşil Test, Doğru Test Değildir

1
// The assistant's first draft. Every single-customer test passes.
2
@RestController
3
class TransactionControllerDraft {
4

5
    private final JdbcTemplate jdbc;
6

7
    TransactionControllerDraft(JdbcTemplate jdbc) {
8
        this.jdbc = jdbc;
9
    }
10

11
    @GetMapping("/accounts/{accountId}/transactions")
12
    List<TransactionLine> list(@PathVariable long accountId, @RequestParam String from) {
13
        // Nobody checks who owns accountId: any logged-in customer can read any account.
14
        // "from" is glued into the SQL text, so it can change the query itself.
15
        return jdbc.query(
16
                "SELECT booked_at, amount, currency, description FROM account_transaction "
17
                        + "WHERE account_id = " + accountId + " AND booked_at >= '" + from + "'",
18
                TransactionLine.MAPPER);
19
    }
20
}

1
@RestController
2
class TransactionController {
3

4
    private final TransactionQuery transactions;
5

6
    TransactionController(TransactionQuery transactions) {
7
        this.transactions = transactions;
8
    }
9

10
    @GetMapping("/accounts/{accountId}/transactions")
11
    List<TransactionLine> list(@PathVariable long accountId,
12
                               @RequestParam LocalDate from,
13
                               @AuthenticationPrincipal Jwt jwt) {
14
        String customerNo = jwt.getSubject();   // who is asking comes from the token, not the request
15
        // 404 rather than 403: a stranger should not even learn that the account exists.
16
        return transactions.forOwner(customerNo, accountId, from)
17
                .orElseThrow(() -> new ResponseStatusException(HttpStatus.NOT_FOUND));
18
    }
19
}

1
@Repository
2
class TransactionQuery {
3

4
    private final NamedParameterJdbcTemplate jdbc;
5

6
    TransactionQuery(NamedParameterJdbcTemplate jdbc) {
7
        this.jdbc = jdbc;
8
    }
9

10
    // Empty when the account is missing or belongs to someone else; callers cannot tell which.
11
    Optional<List<TransactionLine>> forOwner(String customerNo, long accountId, LocalDate from) {
12
        Boolean owns = jdbc.queryForObject(
13
                "SELECT EXISTS (SELECT 1 FROM account WHERE id = :accountId AND customer_no = :customerNo)",
14
                Map.of("accountId", accountId, "customerNo", customerNo),
15
                Boolean.class);
16
        if (!Boolean.TRUE.equals(owns)) {
17
            return Optional.empty();
18
        }
19
        return Optional.of(jdbc.query(
20
                "SELECT booked_at, amount, currency, description FROM account_transaction "
21
                        + "WHERE account_id = :accountId AND booked_at >= :from ORDER BY booked_at",
22
                Map.of("accountId", accountId, "from", from),
23
                TransactionLine.MAPPER));
24
    }
25
}

1
@SpringBootTest
2
@AutoConfigureMockMvc
3
@Sql("/two-customers.sql")   // account 42 belongs to C-1001, account 77 to C-2002
4
class TransactionAccessTest {
5

6
    @Autowired
7
    MockMvc mvc;
8

9
    @Test
10
    void ownerSeesTheirTransactions() throws Exception {
11
        mvc.perform(get("/accounts/42/transactions").param("from", "2026-09-01")
12
                        .with(jwt().jwt(token -> token.subject("C-1001"))))
13
                .andExpect(status().isOk());
14
    }
15

16
    @Test
17
    void anotherCustomerGetsNotFound() throws Exception {
18
        mvc.perform(get("/accounts/42/transactions").param("from", "2026-09-01")
19
                        .with(jwt().jwt(token -> token.subject("C-2002"))))
20
                .andExpect(status().isNotFound());
21
    }
22

23
    @Test
24
    void textInTheDateIsRejected() throws Exception {
25
        mvc.perform(get("/accounts/42/transactions").param("from", "2026-09-01' OR '1'='1")
26
                        .with(jwt().jwt(token -> token.subject("C-1001"))))
27
                .andExpect(status().isBadRequest());
28
    }
29
}