8000
Missing isolated tests for Status Page #3351
Assignees
Comments
This was referenced Nov 6, 2023
|
Follow up on missing tests that were previously deemed "untestable":
|
This was referenced Nov 8, 2023
|
I think we're good. Closing this. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Definition "Isolated Test": An isolated test is a test that triggers exactly the rule it is meant to test and no additional rule.
For the CRS Status Page (see https://github.com/coreruleset/coreruleset/wiki/DevRetreat21StatusPage) we need isolated tests to determine whether individual tests are active on the target platform (that does not give us the logs). We defined that we want 80% coverage with isolated tests for PL4.
In order to get 80% coverage, we need to have 120 isolated tests for the 150 PL1 rules in CRSv4.
Here is the list of tests, where isolated tests are missing:
%uFF48without triggering one of the PL 1 rules that detect encoding abuse (detecting the presence of a%and then performingvalidateUrlEncodingwhich will fail on this weird%u…encoding.)charsetparameter (which an empty header cannot have).charsetparameter (which an empty header cannot have).\s+http/\d, without also triggering PL 1 rule 921130 which matches against\bhttp/\d.❗ Minimal string
<script>triggers 941160 as well. Same target list used in 941110, looks impossible❗ Impossible: Minimal string of 941190
<styletest>@iwill always also match rule 941160 and libinjection rule 941100❗ Impossible: Minimal string of 941230
<embed src=will always also match rule 941160 and libinjection rule 941100❗ Impossible: Minimal string of 941250
<meta http-equiv=will always also match rule 921130, 941160 and libinjection rule 941100❗ Impossible: Minimal string of 941260
<meta+charset=will always also match rule 921130, 941160 and libinjection rule 941100❗ Impossible: First part of 941270
<link+will always also match rule 941160 and libinjection rule 941100❗ Impossible: First part of 941280
<base+will always also match rule 941160 and libinjection rule 941100❗ Impossible: Minimal string of 941290
<applet/will always also match rule 941160 and libinjection rule 941100❗ Impossible: First part of 941300
<OBJECT/will always also match rule 941160 and libinjection rule 941100❗ Impossible to trigger without also triggering 942100 PL1 (libinjection)
❗ Impossible: The minimal string
uri: "/?arg=java.lang.Runtime"will always also match rule 944110 and 944130The 92xxxx test groups are probably impossible to do. So we concentrate on 93xxxx and 94xxxx. 93xxxx is priority, because there are only 4 missing and if we cover those, the entire group is covered. Afterwards 942xxx, then 944xxx and then 941xxx.
The list was created with the help of
baseline-test.shfrom https://github.com/coreruleset/status-page/. Here is the full report:test-coverage.txt
The text was updated successfully, but these errors were encountered: