owasp-input-api-developers

RE: [Owasp-input-api-developers] Testing tool/framework and development platform survey

[Christopher T. <ch...@ch...>]

Alex,

>Probably not. I think it'll be a better bet to find one environment
>against which we can test most of these languages and then spit back
>reports about what succeeded and what failed. Not sure there's a need
>for each of us to configure servers to support all (or even most) of
>these languages. It can only get more complex when we introduce DBs into
>the mix, so for the time being I'm going to advocate a central testing
>setup of some sort. Not sure how we'll make it a reality (suggestions
>welcome), but it seems a good way to start.

Interesting idea; I was thinking more along the lines of iterative
code-test-code-test, but your suggestion would work better in an automated
nightly build type of situation.  Sourceforge has compile farms; I don't
know much about them, but maybe we could setup a nightly build from CVS.
The Jakarta projects (and many Apache projects) do that sort of thing, and
there are several tools to help.

Chris

RE: [Owasp-input-api-developers] Testing tool/framework and development platform survey

[Alex R. <al...@se...>]

On Sun, 18 Aug 2002, Christopher Todd wrote:

> Interesting idea; I was thinking more along the lines of iterative
> code-test-code-test, 

I think that whatever we do, we'll need that capability.

> but your suggestion would work better in an automated
> nightly build type of situation.  

Yeah, I thought of that...Perhaps if there was a set of scripts that (on
demand) made a CVS checkout, tested it, and reported the results
more-or-less instantly?

maybe it'd even take an uploaded source directory tarball and tested
against that...I don't know. I'd like it to be easy for us to use as
part of our development cycle (fireable from a command line?), but I
think a bit of lag might be acceptable.

Thoughts?

-- 
Alex Russell
al...@Se...
al...@ne...

RE: [Owasp-input-api-developers] Testing tool/framework and development platform survey

[Gabriel L. <ga...@bu...>]

On Sun, 2002-08-18 at 15:42, Alex Russell wrote:
> On Sun, 18 Aug 2002, Christopher Todd wrote:
> 
> > Interesting idea; I was thinking more along the lines of iterative
> > code-test-code-test, 
> 
> I think that whatever we do, we'll need that capability.
> 
> > but your suggestion would work better in an automated
> > nightly build type of situation.  
> 
> Yeah, I thought of that...Perhaps if there was a set of scripts that (on
> demand) made a CVS checkout, tested it, and reported the results
> more-or-less instantly?

Yes. We are really going to need something of this type. As a security
product, we really do need to focus on unit testing and system testing
as a key portion of the development. With many authors and new
contributors as is common in open source projects, we need to build some
tools that help assure that checkins don't break the security of the
system. I would suspect nightly builds with test run and the ability for
developers to do a test run would be ideal.




-gabe

-- 
Gabriel Lawrence
CTO
Butterfly Security <www.butterflysecurity.com>
(408) 333-9948
ga...@bu...