Suggestions for BDD scripting for generic API?
I am putting together inspired BDD unit tests for the API portion of my application. (Yes, I know BDD should be about the domain and talk to suit, but I'd rather try out BDD on something less conspicuous in the first place)
Normal use. The developer uses API Methods with normal parameter values.
Extreme use . The developer calls the API with unusually large / small parameters. For example. the zip () method gets a 2 GB file.
API abuse. The developer calls the API with crazy parameters - what kind of crazy programmer will pass the date an Integer parameter, right? --parameters forgotten, etc.
Malicious hacking . The developer doesn't care what the API is for, but looks for ways to execute arbitrary code. The tests will include JavaScript, SQL just to see if we can get them to execute anywhere.
Are there any other scenarios I should consider?
source to share
Of course, there are always more scenarios to consider. Quite frankly, there is an almost limitless pool of scripts. This is an extremely open question.
As far as malicious hacking scenarios go, you really only need to worry about the obvious buffer overflow locations and then continue testing for confirmed vulnerabilities so you don't accidentally open them again. And every time you get a confirmed vulnerability, hunt down all places in the code where similar programming methods and patterns are used, and also test / fix them first. In many cases, however, fuzzing will give you better results. Automated testing is an important part of solving security problems, but by no means should it be the main tool in a toolbox.
Other things to consider may be related to specific data. For example, when parsing dates, be sure to handle things like 02/29/2009 or 09/31/2009. If you can, try to deal with 01/01/1900 and 12/31/2038 (your library may not allow you).
One thing you can do is check the documentation for all the library calls you make, figure out which exceptions are thrown under what conditions, and deliberately try to find the input that will throw those exceptions, then make sure you have tests which verify that these exceptions are either handled or, in the case of library code, documented.
Code coverage tools and code mutation can also help you identify scenarios that were not previously covered.
source to share