Menu

#33 Security problem - any testcase can be run

open
5
2007-09-21
2007-09-21
No

There is no way to control what test cases that can be run.

I added the below to stop testcases "not on the list" from being executed.

/* Check that all tests cases are part of our complete list so as to avoid someone trying to
* run a testcase that is not meant to be run in a production environment.
*/
String allTests[]=searchForTests((String)null);
for (int i=0; i<testClassNames.length; i++)
{
boolean found=false;
for (int j=0; j<allTests.length; j++)
{
if (testClassNames[i].equals(allTests[j]))
{
found=true;
break;
}
}
if (!found)
{
throw new RuntimeException("Illegal test case name");
}
}

Discussion


Log in to post a comment.