Doc/Injection Test Audit

[theiris6]

Description

This PR adds a comprehensive SQL Injection vulnerability assessment to the security documentation section. It includes a detailed report outlining the vulnerability, test methodologies, results, and recommended actions, along with an automated test script for future security checks.
The assessment found that the application successfully blocks all common SQL injection attack patterns, with all test cases returning appropriate error codes and sanitized error messages. The Nikto security scanner detected no SQL injection vulnerabilities. Some HTTP security headers improvements were identified as potential enhancements.

Fixes # (issue)

Type of change

• Documentation (update or new)

How Has This Been Tested?

The test-sql-injection.sh script performs the following tests:

1. Baseline Authentication Verification

• Tests that the API responds to legitimate credentials
• Verifies the application's authentication endpoint is functioning

2. Username Field SQL Injection Tests

• Tests 6 different SQL injection payloads in the username field
• Verifies that injection attempts return 401 status codes
• Confirms error messages are properly sanitized
• All tests passed with no vulnerabilities detected

3. Password Field SQL Injection Tests

• Tests 6 different SQL injection payloads in the password field
• Verifies that injection attempts return 401 status codes
• Confirms error messages are properly sanitized
• All tests passed with no vulnerabilities detected

4. Nikto Security Scan

• Performs comprehensive web vulnerability scanning
• Specifically targets SQL injection vulnerabilities
• Found no SQL injection vulnerabilities
• Identified some HTTP security header recommendations

Testing Checklist

• Tested in latest Chrome
• Tested in latest Safari
• Tested in latest Firefox

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have requested a review from ... on the Pull Request

[netlify]

❌ Deploy Preview for ontrackdocumentation failed.

Name	Link
🔨 Latest commit	3bbabdb
🔍 Latest deploy log	https://app.netlify.com/sites/ontrackdocumentation/deploys/6821ff8fb4c34a00080e0f20

[ibi420]

Hello Iris, I have reviewed your documentation and script. Your documentation is well structured and in the appropriate format as dictated in Doubtfire's documentation. Your script functions well and provided similar results to what is listed in your documentation, i.e. the fields are resistant to SQL injection. My only suggestion is to avoid hardcoding the URLs into the script and make them input fields. This would make your work more customizable to the developer running the tests. Thank you for the opportunity to review your work.

[ibi420]

Iris, upon reviewing your recent submission, I confirm the successful integration of my suggestion. Your work is commendable. Thank you for the opportunity to provide feedback.

[atharv02-git]

Hi @theiris6, I just finished running your test-sql-injection.sh script against my local OnTrack instance, and here's my review:

What I tested:

1. Checked endpoint reachability using curl
   I confirmed that the /api/auth endpoint is active and correctly rejects unsupported methods. I got a 405 Not Allowed, which is expected for a GET request.
   

2. Ran the full SQL Injection test script

   • Valid credentials worked correctly; received an auth token.
   • All 6 injection attempts on both the username and password fields were properly blocked with 401 responses.
   • Error messages were sanitized, and no sensitive info was leaked.
   • Nikto scan was skipped on my end (not installed), but the manual tests gave high confidence.
     

Improvement:

I also noticed that you’ve taken Ibi’s earlier feedback into account and updated the script to remove hardcoded values replacing them with variables, a config file, and CLI flags. That’s a great touch and makes the script much more reusable and developer-friendly.

Overall, this is a really well-done PR. Your documentation is clear, and the script is really functional, flexible and easy to use. Happy to approve this! 🫡