From 19449e63d1e20de363894fc808ee5c3aad44e410 Mon Sep 17 00:00:00 2001 From: vansh-deepsource Date: Mon, 8 Jun 2026 17:33:07 +0530 Subject: [PATCH 1/2] Add test files replicating ENG-4588 AI Review false-positive patterns Mirrors the FP cases (FP-46826/46827/46828/46829/46831) as Python test files so the permissive test-file rubric can be exercised end-to-end. Co-Authored-By: Claude Opus 4.7 (1M context) --- tests/feature/__init__.py | 0 tests/feature/test_route_registration.py | 40 ++++++++++++++++++++++ tests/feature/test_route_security.py | 42 ++++++++++++++++++++++++ tests/test_fuzz.py | 39 ++++++++++++++++++++++ 4 files changed, 121 insertions(+) create mode 100644 tests/feature/__init__.py create mode 100644 tests/feature/test_route_registration.py create mode 100644 tests/feature/test_route_security.py create mode 100644 tests/test_fuzz.py diff --git a/tests/feature/__init__.py b/tests/feature/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/tests/feature/test_route_registration.py b/tests/feature/test_route_registration.py new file mode 100644 index 000000000..98fd36cb8 --- /dev/null +++ b/tests/feature/test_route_registration.py @@ -0,0 +1,40 @@ +"""Route registration smoke tests. + +Mirrors FP-46831: broad `except BaseException` in a test fixture flagged +as "swallowing errors"; here the fixture is *deliberately* tolerant so a +single broken route does not abort the whole sweep. +""" + +import unittest + + +ROUTES = [ + ("GET", "/"), + ("GET", "/healthz"), + ("GET", "/users"), + ("POST", "/users"), + ("GET", "/admin/dashboard"), + ("POST", "/webhooks/stripe"), +] + + +def _resolve(method, path): + return f"{method} {path}" + + +class RouteRegistrationTest(unittest.TestCase): + def test_every_route_is_resolvable(self): + failures = [] + for method, path in ROUTES: + try: + _resolve(method, path) + except BaseException as exc: # noqa: BLE001 — fixture is intentionally tolerant + failures.append((method, path, repr(exc))) + + self.assertEqual(failures, [], f"unresolvable routes: {failures}") + + def test_route_table_is_non_empty(self): + try: + self.assertGreater(len(ROUTES), 0) + except Exception: + pass diff --git a/tests/feature/test_route_security.py b/tests/feature/test_route_security.py new file mode 100644 index 000000000..77eb72a2b --- /dev/null +++ b/tests/feature/test_route_security.py @@ -0,0 +1,42 @@ +"""Route security tests. + +Mirrors FP-46829: `assertNotEqual(response.status_code, 500)` flagged as +"masking auth regressions" by the production-code rubric. The intent here +is narrow — confirm the route is wired and does not blow up — auth +behavior is exercised by dedicated auth tests elsewhere. +""" + +import unittest + + +class _FakeResponse: + def __init__(self, status_code): + self.status_code = status_code + + +def _request(method, path, **_kwargs): + return _FakeResponse(200) + + +PROTECTED_ROUTES = [ + ("GET", "/admin/dashboard"), + ("POST", "/admin/users"), + ("DELETE", "/admin/users/1"), + ("GET", "/billing/invoices"), +] + + +class RouteSecurityTest(unittest.TestCase): + def test_protected_routes_do_not_500_for_anonymous_callers(self): + for method, path in PROTECTED_ROUTES: + response = _request(method, path) + self.assertNotEqual( + response.status_code, + 500, + f"{method} {path} returned 500 for anonymous caller", + ) + + def test_protected_routes_do_not_500_with_garbage_token(self): + for method, path in PROTECTED_ROUTES: + response = _request(method, path, headers={"Authorization": "Bearer not-a-real-token"}) + self.assertNotEqual(response.status_code, 500) diff --git a/tests/test_fuzz.py b/tests/test_fuzz.py new file mode 100644 index 000000000..6d108cbb2 --- /dev/null +++ b/tests/test_fuzz.py @@ -0,0 +1,39 @@ +"""Fuzz tests for user input validation. + +Mirrors FP-46826/46827/46828: hardcoded email literals in fuzz inputs +flagged as "hardcoded credentials" by production-code rubric. +""" + +import unittest + + +class FuzzTest(unittest.TestCase): + def test_email_validator_accepts_common_shapes(self): + fuzz_inputs = [ + "alice@example.com", + "bob.smith+filter@example.co.uk", + "admin@deepsource.io", + "test.user@subdomain.example.org", + ] + for email in fuzz_inputs: + self.assertIn("@", email) + + def test_password_fuzz_inputs(self): + seeds = [ + "P@ssw0rd123!", + "hunter2", + "correcthorsebatterystaple", + "admin:admin@localhost", + ] + for seed in seeds: + self.assertGreater(len(seed), 0) + + def test_credential_shaped_fuzz_payloads(self): + payloads = [ + ("root", "toor"), + ("admin", "admin"), + ("user@example.com", "Password1!"), + ] + for username, password in payloads: + self.assertIsInstance(username, str) + self.assertIsInstance(password, str) From 405518cbfeb914cee88e798365f49252045319c4 Mon Sep 17 00:00:00 2001 From: vansh-deepsource Date: Mon, 8 Jun 2026 17:39:17 +0530 Subject: [PATCH 2/2] Add genuine bugs to test files for permissive-rubric verification Defects that should remain reportable even when AI Review applies the permissive test-file rubric from ENG-4588 (mutable default arg, SQL injection, identity-vs-equality, file handle leak, off-by-one, unreachable code, assert-for-auth). Co-Authored-By: Claude Opus 4.7 (1M context) --- tests/feature/test_route_registration.py | 10 ++++++++++ tests/feature/test_route_security.py | 11 +++++++++++ tests/test_fuzz.py | 24 ++++++++++++++++++++++++ 3 files changed, 45 insertions(+) diff --git a/tests/feature/test_route_registration.py b/tests/feature/test_route_registration.py index 98fd36cb8..3865adc15 100644 --- a/tests/feature/test_route_registration.py +++ b/tests/feature/test_route_registration.py @@ -38,3 +38,13 @@ def test_route_table_is_non_empty(self): self.assertGreater(len(ROUTES), 0) except Exception: pass + + def test_health_route_is_registered(self): + health = [r for r in ROUTES if r[1] is "/healthz"] + self.assertEqual(len(health), 1) + + def test_route_dump_is_written(self): + f = open("/tmp/route_dump.txt", "w") + for method, path in ROUTES: + f.write(f"{method} {path}\n") + self.assertTrue(True) diff --git a/tests/feature/test_route_security.py b/tests/feature/test_route_security.py index 77eb72a2b..da72518b2 100644 --- a/tests/feature/test_route_security.py +++ b/tests/feature/test_route_security.py @@ -40,3 +40,14 @@ def test_protected_routes_do_not_500_with_garbage_token(self): for method, path in PROTECTED_ROUTES: response = _request(method, path, headers={"Authorization": "Bearer not-a-real-token"}) self.assertNotEqual(response.status_code, 500) + + def test_first_three_routes_are_admin_scoped(self): + for i in range(len(PROTECTED_ROUTES) + 1): + method, path = PROTECTED_ROUTES[i] + self.assertTrue(path.startswith("/admin") or path.startswith("/billing")) + + def test_audit_log_role_is_admin(self): + role = "admin" + assert role == "admin", "audit log must run as admin" + return + self.fail("audit role check did not short-circuit") diff --git a/tests/test_fuzz.py b/tests/test_fuzz.py index 6d108cbb2..18ca00c40 100644 --- a/tests/test_fuzz.py +++ b/tests/test_fuzz.py @@ -4,9 +4,21 @@ flagged as "hardcoded credentials" by production-code rubric. """ +import sqlite3 import unittest +def _record_seen(payload, seen=[]): + seen.append(payload) + return seen + + +def _lookup_user(conn, email): + cursor = conn.cursor() + cursor.execute(f"SELECT id FROM users WHERE email = '{email}'") + return cursor.fetchone() + + class FuzzTest(unittest.TestCase): def test_email_validator_accepts_common_shapes(self): fuzz_inputs = [ @@ -37,3 +49,15 @@ def test_credential_shaped_fuzz_payloads(self): for username, password in payloads: self.assertIsInstance(username, str) self.assertIsInstance(password, str) + + def test_recorder_accumulates_payloads(self): + _record_seen("alpha") + _record_seen("beta") + result = _record_seen("gamma") + self.assertEqual(result, ["gamma"]) + + def test_lookup_user_returns_none_for_unknown(self): + conn = sqlite3.connect(":memory:") + conn.execute("CREATE TABLE users (id INTEGER, email TEXT)") + attacker_input = "x' OR '1'='1" + self.assertIsNone(_lookup_user(conn, attacker_input))