From 19449e63d1e20de363894fc808ee5c3aad44e410 Mon Sep 17 00:00:00 2001 From: vansh-deepsource Date: Mon, 8 Jun 2026 17:33:07 +0530 Subject: [PATCH 1/3] Add test files replicating ENG-4588 AI Review false-positive patterns Mirrors the FP cases (FP-46826/46827/46828/46829/46831) as Python test files so the permissive test-file rubric can be exercised end-to-end. Co-Authored-By: Claude Opus 4.7 (1M context) --- tests/feature/__init__.py | 0 tests/feature/test_route_registration.py | 40 ++++++++++++++++++++++ tests/feature/test_route_security.py | 42 ++++++++++++++++++++++++ tests/test_fuzz.py | 39 ++++++++++++++++++++++ 4 files changed, 121 insertions(+) create mode 100644 tests/feature/__init__.py create mode 100644 tests/feature/test_route_registration.py create mode 100644 tests/feature/test_route_security.py create mode 100644 tests/test_fuzz.py diff --git a/tests/feature/__init__.py b/tests/feature/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/tests/feature/test_route_registration.py b/tests/feature/test_route_registration.py new file mode 100644 index 000000000..98fd36cb8 --- /dev/null +++ b/tests/feature/test_route_registration.py @@ -0,0 +1,40 @@ +"""Route registration smoke tests. + +Mirrors FP-46831: broad `except BaseException` in a test fixture flagged +as "swallowing errors"; here the fixture is *deliberately* tolerant so a +single broken route does not abort the whole sweep. +""" + +import unittest + + +ROUTES = [ + ("GET", "/"), + ("GET", "/healthz"), + ("GET", "/users"), + ("POST", "/users"), + ("GET", "/admin/dashboard"), + ("POST", "/webhooks/stripe"), +] + + +def _resolve(method, path): + return f"{method} {path}" + + +class RouteRegistrationTest(unittest.TestCase): + def test_every_route_is_resolvable(self): + failures = [] + for method, path in ROUTES: + try: + _resolve(method, path) + except BaseException as exc: # noqa: BLE001 — fixture is intentionally tolerant + failures.append((method, path, repr(exc))) + + self.assertEqual(failures, [], f"unresolvable routes: {failures}") + + def test_route_table_is_non_empty(self): + try: + self.assertGreater(len(ROUTES), 0) + except Exception: + pass diff --git a/tests/feature/test_route_security.py b/tests/feature/test_route_security.py new file mode 100644 index 000000000..77eb72a2b --- /dev/null +++ b/tests/feature/test_route_security.py @@ -0,0 +1,42 @@ +"""Route security tests. + +Mirrors FP-46829: `assertNotEqual(response.status_code, 500)` flagged as +"masking auth regressions" by the production-code rubric. The intent here +is narrow — confirm the route is wired and does not blow up — auth +behavior is exercised by dedicated auth tests elsewhere. +""" + +import unittest + + +class _FakeResponse: + def __init__(self, status_code): + self.status_code = status_code + + +def _request(method, path, **_kwargs): + return _FakeResponse(200) + + +PROTECTED_ROUTES = [ + ("GET", "/admin/dashboard"), + ("POST", "/admin/users"), + ("DELETE", "/admin/users/1"), + ("GET", "/billing/invoices"), +] + + +class RouteSecurityTest(unittest.TestCase): + def test_protected_routes_do_not_500_for_anonymous_callers(self): + for method, path in PROTECTED_ROUTES: + response = _request(method, path) + self.assertNotEqual( + response.status_code, + 500, + f"{method} {path} returned 500 for anonymous caller", + ) + + def test_protected_routes_do_not_500_with_garbage_token(self): + for method, path in PROTECTED_ROUTES: + response = _request(method, path, headers={"Authorization": "Bearer not-a-real-token"}) + self.assertNotEqual(response.status_code, 500) diff --git a/tests/test_fuzz.py b/tests/test_fuzz.py new file mode 100644 index 000000000..6d108cbb2 --- /dev/null +++ b/tests/test_fuzz.py @@ -0,0 +1,39 @@ +"""Fuzz tests for user input validation. + +Mirrors FP-46826/46827/46828: hardcoded email literals in fuzz inputs +flagged as "hardcoded credentials" by production-code rubric. +""" + +import unittest + + +class FuzzTest(unittest.TestCase): + def test_email_validator_accepts_common_shapes(self): + fuzz_inputs = [ + "alice@example.com", + "bob.smith+filter@example.co.uk", + "admin@deepsource.io", + "test.user@subdomain.example.org", + ] + for email in fuzz_inputs: + self.assertIn("@", email) + + def test_password_fuzz_inputs(self): + seeds = [ + "P@ssw0rd123!", + "hunter2", + "correcthorsebatterystaple", + "admin:admin@localhost", + ] + for seed in seeds: + self.assertGreater(len(seed), 0) + + def test_credential_shaped_fuzz_payloads(self): + payloads = [ + ("root", "toor"), + ("admin", "admin"), + ("user@example.com", "Password1!"), + ] + for username, password in payloads: + self.assertIsInstance(username, str) + self.assertIsInstance(password, str) From 405518cbfeb914cee88e798365f49252045319c4 Mon Sep 17 00:00:00 2001 From: vansh-deepsource Date: Mon, 8 Jun 2026 17:39:17 +0530 Subject: [PATCH 2/3] Add genuine bugs to test files for permissive-rubric verification Defects that should remain reportable even when AI Review applies the permissive test-file rubric from ENG-4588 (mutable default arg, SQL injection, identity-vs-equality, file handle leak, off-by-one, unreachable code, assert-for-auth). Co-Authored-By: Claude Opus 4.7 (1M context) --- tests/feature/test_route_registration.py | 10 ++++++++++ tests/feature/test_route_security.py | 11 +++++++++++ tests/test_fuzz.py | 24 ++++++++++++++++++++++++ 3 files changed, 45 insertions(+) diff --git a/tests/feature/test_route_registration.py b/tests/feature/test_route_registration.py index 98fd36cb8..3865adc15 100644 --- a/tests/feature/test_route_registration.py +++ b/tests/feature/test_route_registration.py @@ -38,3 +38,13 @@ def test_route_table_is_non_empty(self): self.assertGreater(len(ROUTES), 0) except Exception: pass + + def test_health_route_is_registered(self): + health = [r for r in ROUTES if r[1] is "/healthz"] + self.assertEqual(len(health), 1) + + def test_route_dump_is_written(self): + f = open("/tmp/route_dump.txt", "w") + for method, path in ROUTES: + f.write(f"{method} {path}\n") + self.assertTrue(True) diff --git a/tests/feature/test_route_security.py b/tests/feature/test_route_security.py index 77eb72a2b..da72518b2 100644 --- a/tests/feature/test_route_security.py +++ b/tests/feature/test_route_security.py @@ -40,3 +40,14 @@ def test_protected_routes_do_not_500_with_garbage_token(self): for method, path in PROTECTED_ROUTES: response = _request(method, path, headers={"Authorization": "Bearer not-a-real-token"}) self.assertNotEqual(response.status_code, 500) + + def test_first_three_routes_are_admin_scoped(self): + for i in range(len(PROTECTED_ROUTES) + 1): + method, path = PROTECTED_ROUTES[i] + self.assertTrue(path.startswith("/admin") or path.startswith("/billing")) + + def test_audit_log_role_is_admin(self): + role = "admin" + assert role == "admin", "audit log must run as admin" + return + self.fail("audit role check did not short-circuit") diff --git a/tests/test_fuzz.py b/tests/test_fuzz.py index 6d108cbb2..18ca00c40 100644 --- a/tests/test_fuzz.py +++ b/tests/test_fuzz.py @@ -4,9 +4,21 @@ flagged as "hardcoded credentials" by production-code rubric. """ +import sqlite3 import unittest +def _record_seen(payload, seen=[]): + seen.append(payload) + return seen + + +def _lookup_user(conn, email): + cursor = conn.cursor() + cursor.execute(f"SELECT id FROM users WHERE email = '{email}'") + return cursor.fetchone() + + class FuzzTest(unittest.TestCase): def test_email_validator_accepts_common_shapes(self): fuzz_inputs = [ @@ -37,3 +49,15 @@ def test_credential_shaped_fuzz_payloads(self): for username, password in payloads: self.assertIsInstance(username, str) self.assertIsInstance(password, str) + + def test_recorder_accumulates_payloads(self): + _record_seen("alpha") + _record_seen("beta") + result = _record_seen("gamma") + self.assertEqual(result, ["gamma"]) + + def test_lookup_user_returns_none_for_unknown(self): + conn = sqlite3.connect(":memory:") + conn.execute("CREATE TABLE users (id INTEGER, email TEXT)") + attacker_input = "x' OR '1'='1" + self.assertIsNone(_lookup_user(conn, attacker_input)) From cf6500fc0ca95de4151a4d508593172f3551e76f Mon Sep 17 00:00:00 2001 From: vansh-deepsource Date: Tue, 9 Jun 2026 09:01:55 +0530 Subject: [PATCH 3/3] Add scoped and unscoped suppression comments to seeded test bugs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Covers noqa, nosec, skipcq, and pylint disable styles — mix of bare and code-scoped — so suppression-handling can be exercised against the permissive test-file rubric. Co-Authored-By: Claude Opus 4.7 (1M context) --- tests/feature/test_route_registration.py | 4 ++-- tests/feature/test_route_security.py | 6 +++--- tests/test_fuzz.py | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/tests/feature/test_route_registration.py b/tests/feature/test_route_registration.py index 3865adc15..9b5564ba0 100644 --- a/tests/feature/test_route_registration.py +++ b/tests/feature/test_route_registration.py @@ -40,11 +40,11 @@ def test_route_table_is_non_empty(self): pass def test_health_route_is_registered(self): - health = [r for r in ROUTES if r[1] is "/healthz"] + health = [r for r in ROUTES if r[1] is "/healthz"] # noqa self.assertEqual(len(health), 1) def test_route_dump_is_written(self): - f = open("/tmp/route_dump.txt", "w") + f = open("/tmp/route_dump.txt", "w") # skipcq: PYL-R1732 for method, path in ROUTES: f.write(f"{method} {path}\n") self.assertTrue(True) diff --git a/tests/feature/test_route_security.py b/tests/feature/test_route_security.py index da72518b2..ca0ede5e3 100644 --- a/tests/feature/test_route_security.py +++ b/tests/feature/test_route_security.py @@ -42,12 +42,12 @@ def test_protected_routes_do_not_500_with_garbage_token(self): self.assertNotEqual(response.status_code, 500) def test_first_three_routes_are_admin_scoped(self): - for i in range(len(PROTECTED_ROUTES) + 1): + for i in range(len(PROTECTED_ROUTES) + 1): # pylint: disable method, path = PROTECTED_ROUTES[i] self.assertTrue(path.startswith("/admin") or path.startswith("/billing")) def test_audit_log_role_is_admin(self): role = "admin" - assert role == "admin", "audit log must run as admin" + assert role == "admin", "audit log must run as admin" # nosec: B101 return - self.fail("audit role check did not short-circuit") + self.fail("audit role check did not short-circuit") # skipcq diff --git a/tests/test_fuzz.py b/tests/test_fuzz.py index 18ca00c40..29a98a801 100644 --- a/tests/test_fuzz.py +++ b/tests/test_fuzz.py @@ -8,14 +8,14 @@ import unittest -def _record_seen(payload, seen=[]): +def _record_seen(payload, seen=[]): # noqa: B006 seen.append(payload) return seen def _lookup_user(conn, email): cursor = conn.cursor() - cursor.execute(f"SELECT id FROM users WHERE email = '{email}'") + cursor.execute(f"SELECT id FROM users WHERE email = '{email}'") # nosec return cursor.fetchone()