Project

General

Profile

Feature #9448

compatibility test security features

Added by Greg Shah over 1 year ago. Updated 5 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
-
Start date:
Due date:
% Done:

100%

billable:
No
vendor_id:
GCD
case_num:
version_reported:
version_resolved:
production:
No
env_name:
topics:

Related issues

Related to Base Language - Bug #11042: NativeInvoker may generate memptr with unknown size Test
Related to Base Language - Bug #11149: DO i = 1 TO LENGTH(r, "RAW") converts to incompatible type expression Review

History

#1 Updated by Greg Shah over 1 year ago

Check the tests in Testcases to ensure they are complete and comprehensive. Add tests if needed. Convert and run the tests. Fix any issues as needed until the test pass completely.

These are the features to test:

  • GUID/GENERATE-UUID (full/basic)
  • HEX-ENCODE()/HEX-DECODE() (full/untested)
  • MD5-DIGEST() (full/basic)
  • SECURITY-POLICY:REGISTER-DOMAIN() (full/basic)
  • SECURITY-POLICY:LOCK-REGISTRATION() (full/basic) used in a FINALLY block

#2 Updated by Greg Shah over 1 year ago

  • Subject changed from compatibility test for security features to compatibility test security features

#3 Updated by Alexandru Lungu over 1 year ago

  • Assignee set to Stefan Vieru

#4 Updated by Constantin Asofiei about 1 year ago

  • Assignee changed from Stefan Vieru to Teodor Gorghe

#5 Updated by Teodor Gorghe about 1 year ago

  • Status changed from New to WIP
  • % Done changed from 0 to 10
  • reviewer Constantin Asofiei added

Created a new branch 9448a.
Commited revision 15945 on branch 9448a.
- MD5-DIGEST: fixed conversion issue on MD5-DIGEST(?).
- MD5-DIGEST: Added support for BaseDataType, for the first parameter.
For fixing the compiling issue, I added <action>putNote("classname", "raw")</action> to add classname annotation for MD5-DIGEST. This makes the code from common-progress.rules to add the unknown value on the function call. Is there a more elegant way to fix this issue?

╷
├─ JUnit Jupiter ✔
├─ JUnit Vintage ✔
├─ JUnit Platform Suite ✔
└─ FWD Test ✔
   └─ tests.base_language.builtin_functions.functionality.TestMd5Digest ✔
      ├─ testCharDifferentCalls ✔
      ├─ testCharFunction ✔
      ├─ testCharKeyParameter ✔
      ├─ testLongCharFunction ✔
      ├─ testLongCharDifferentCalls ✔
      ├─ testCharLongCharKeyParameters ✔
      ├─ testLongCharCharKeyParameters ✔
      ├─ testMemptrCharKeyParameters ✔
      ├─ testRawCharKeyParameters ✔
      ├─ testCharMemptrKeyParameters ✔
      ├─ testCharRawkeyParameters ✔
      ├─ testCharBdtcharParameters ✔
      ├─ testRawBdtcharParameters ✔
      ├─ testCharCharBdtparameters ✔
      ├─ testCharRawBdtparameters ✔
      ├─ testCharInvalidBdtparameters ✔
      ├─ testInvalidBdtfunction ✔
      ├─ testCharBdtfunction ✔
      ├─ testRawBdtfunction ✔
      └─ testUnknown ✔

Test run finished after 423 ms
[         5 containers found      ]
[         0 containers skipped    ]
[         5 containers started    ]
[         0 containers aborted    ]
[         5 containers successful ]
[         0 containers failed     ]
[        20 tests found           ]
[         0 tests skipped         ]
[        20 tests started         ]
[         0 tests aborted         ]
[        20 tests successful      ]
[         0 tests failed          ]

#6 Updated by Greg Shah about 1 year ago

How extensive are the tests? Did you write them or are they pre-existing?

For fixing the compiling issue, I added <action>putNote("classname", "raw")</action> to add classname annotation for MD5-DIGEST. This makes the code from common-progress.rules to add the unknown value on the function call. Is there a more elegant way to fix this issue?

Constantin: Don't we automatically handle this if the parameter is marked as a poly in the signature helper?

#7 Updated by Teodor Gorghe about 1 year ago

There are some tests for MD5-DIGEST (exactly one test method), but I have extended to more methods and added more test cases. I shall commit right now, the tests I have added for MD5-DIGEST?

#8 Updated by Greg Shah about 1 year ago

Yes, please do check them in and update Security Tests with the details of your changes.

#9 Updated by Greg Shah about 1 year ago

+Marian

#10 Updated by Teodor Gorghe about 1 year ago

Commited revision 1753 on testcases.

#11 Updated by Teodor Gorghe about 1 year ago

I have found an issue, but is not related with this task.
For instance, the code provided below fails on FWD:

    @Test.
    method public void testCompleteDecode():
        define variable cLongChar as longchar no-undo.
        define variable rawResult as raw no-undo.
        define variable i as integer no-undo.

        cLongChar = "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff".
        rawResult = hex-decode(cLongChar).

        do i = 1 to length(rawResult):
            Assert:Equals(i - 1, get-byte(rawResult, i)).
        end.
    end method.

Error:

    [javac] Compiling 10 source files to /home/tg/gcd/testcases2/testcases/build/classes
    [javac] /home/tg/gcd/testcases2/testcases/src/com/goldencode/testcases/tests/base_language/builtin_functions/functionality/TestHexDecode.java:173: error: incompatible types: int64 cannot be converted to integer
    [javac]                return BinaryData.length(rawResult);

Is there any open task, that addresses this issue?

#12 Updated by Constantin Asofiei about 1 year ago

Please post what the Java code is on line 173.

#13 Updated by Greg Shah about 1 year ago

We should fix that issue as part of this task.

#14 Updated by Teodor Gorghe about 1 year ago

Constantin Asofiei wrote:

Please post what the Java code is on line 173.

Converted code:

156   @LegacySignature(type = Type.METHOD, name = "testCompleteDecode")
157   @Test(order = 6)
158   public void testCompleteDecode()
159   {
160      longchar cLongChar = TypeFactory.longchar();
161      raw rawResult = TypeFactory.raw();
162      integer i = TypeFactory.integer();
163      
164      internalProcedure(TestHexDecode.class, this, "testCompleteDecode", new Block((Body) () -> 
165      {
166         cLongChar.assign(new character("000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff"));
167         rawResult.assign(SecurityOps.hexDecode(cLongChar));
168         
169         IntegerExpression resExpr0 = new IntegerExpression()
170         {
171            public integer execute()
172            {
173               return BinaryData.length(rawResult);
174            }
175         };
176         ToClause toClause0 = new ToClause(i, 1, resExpr0);
177         
178         doTo("loopLabel0", toClause0, new Block((Body) () -> 
179         {
180            {
181               Assert.legacyEquals(InputParameter.cast(integer.class, minus(new integer(i), new integer(1))), rawResult.getByte(i));
182            }
183         }));
184      }));
185   }

#15 Updated by Marian Edu about 1 year ago

Greg Shah wrote:

+Marian

Yes, tests classes for builtin functions especially only have one test method - the reason is probably because those were generated first to check conversion support. There are usually multiple asserts in that TestFunction method but beside testing the functions with some valid/invalid input parameters asserting the result, afraid there are no tests that can actually help infer the implementation of those functions.

#16 Updated by Teodor Gorghe about 1 year ago

  • % Done changed from 10 to 40

GUID:
- wrong error code when throwing invalid poli type "Statement expected to throw error with number 12708 at index 1 but got 5729".

GENERATE-UUID:
- no problems found.

HEX-ENCODE:
- invalid poli type throws invalid error "Statement expected to throw error with number 12117 at index 1 but got 5729".

HEX-DECODE:
- invalid poli type does not throw any error (it should throw 12117).

GET-BYTE:
- Array index out of bounds on empty raw type. It should return unknown value.

I will document all the issues, after I will test SECURITY-POLICY:REGISTER-DOMAIN() and SECURITY-POLICY:LOCK-REGISTRATION(). They require db1 setup.

#17 Updated by Teodor Gorghe about 1 year ago

  • % Done changed from 40 to 50

SecurityPolicy tests uses external database files (db/db1/db1.db, db/db2/db2.db, ...).
SECURITY-POLICY:LOCK-REGISTRATION() and SECURITY-POLICY:REGISTER-DOMAIN() uses external db1 (with CONNECT statement) and then uses SECURITY-POLICY:LOAD-DOMAINS("db1") to load domains from db1.
I have managed to configure that database on ABL 4GL, but how this translates into FWD?
When running multiple tests on 4GL, some tests require clean (or unlocked) domain registry (on TestRegisterDomain, testRegisterDomainErrorsLoadDomains executes after testRegisterDomainErrorsAndBoundaries, which SECURITY-POLICY:LOAD-DOMAINS will failed because SECURITY-POLICY:REGISTER-DOMAIN was called.

Problems found so far:
- SECURITY-POLICY:LOCK-REGISTRATION(): when there is no domain in the registry, this function should not lock the registration and return true. In FWD, this locks registration. I have fixed that with:

681      if (registry.domains.isEmpty())
682      {
683         return logical.of(true);
684      }

- SECURITY-POLICY:REGISTER-DOMAIN()
added some checks when the domainName and accessCode are unknown values
637      if (domainName == null || domainName.isUnknown() || accessCode == null || accessCode.isUnknown())
638      {
639         ErrorManager.recordOrShowError(4104,
640                                        "Unknown error code -10 for attribute" +
641                                           "REGISTER-DOMAIN on the PSEUDO-WIDGET.");
642         return logical.FALSE;
643      }

Added some checks when SECURITY-POLICY:LOAD-DOMAINS was called.

#18 Updated by Constantin Asofiei about 1 year ago

Teodor, what work is left here?

#19 Updated by Teodor Gorghe about 1 year ago

I think there is no more work to do on this task. I am preparing to commit the changes from SECURITY-POLICY. I think I need to revert the fix for UNKNOWN parameter on MD5-DIGEST, since it's an issue which affects on every builtin function which has BDT on signature.

#20 Updated by Teodor Gorghe about 1 year ago

  • Status changed from WIP to Review
  • % Done changed from 50 to 100

Committed revision 15946 on task branch 9448a:
- Fix for HEX-ENCODE and HEX-DECODE when using BDT values.
- Fix for LOCK-REGISTRATION and REGISTER-DOMAIN with better error handling.

#21 Updated by Constantin Asofiei about 1 year ago

Review for 9448a rev 15946:
  • please rebase
  • in BinaryData, why is rely on IndexOutOfBoundsException and not check the bounds via internalLength?

#22 Updated by Teodor Gorghe about 1 year ago

Constantin Asofiei wrote:

Review for 9448a rev 15946:
  • please rebase
  • in BinaryData, why is rely on IndexOutOfBoundsException and not check the bounds via internalLength?

Rebased branch into rev 16063.
Committed revision 16067 on task branch 9448a:
- addressed code review #9448-21.

#23 Updated by Constantin Asofiei 12 months ago

Teodor, for the changes in SecurityPolicyManager:
  • lockRegistration, loadDomainsFailed - isError was changed from false to true - please also check with DO ON ERROR UNDO, LEAVE: ... some code ... MESSAGE "ERROR condition not thrown". END, and not just with NO-ERROR
  • loadDomains - why is registry.lock(); called?

#24 Updated by Teodor Gorghe 12 months ago

Constantin Asofiei wrote:

Teodor, for the changes in SecurityPolicyManager:
  • lockRegistration, loadDomainsFailed - isError was changed from false to true - please also check with DO ON ERROR UNDO, LEAVE: ... some code ... MESSAGE "ERROR condition not thrown". END, and not just with NO-ERROR
  • loadDomains - why is registry.lock(); called?

On lockRegistration, recordOrShowError is used, with DO ON ERROR UNDO, LEAVE, only records the error (not throw).
On OE 4GL, with DO ON ERROR UNDO, LEAVE block, LOCK-REGISTRATION continues the execution after error. Same happens on FWD.
I changed isError because I get this issue on AssertExt:Error: testMethod ✘ Statement expected to throw error but only raised warning.. This works on OE 4GL, so, it must be an error.

About LOAD-DOMAINS, I have noticed that this method locks the REGISTRY after call. The tests written by Marian checks for this functionality. Please check this example on 4GL OE:

connect db\db1\db1 -1.
// If you place a REGISTER-DOMAIN call here, this works and LOAD-DOMAINS FAILS
security-policy:load-domains('db1'). // Success
// ... You can call LOAD-DOMAINS multiple times
security-policy:register-domain('common', 'common','domain description'). // fails with 14560 'SECURITY-POLICY:REGISTER-DOMAIN failed because the registry is already locked'

#25 Updated by Constantin Asofiei 12 months ago

  • Status changed from Review to Internal Test

Go ahead with regression testing.

#26 Updated by Alexandru Lungu 11 months ago

Teodor, is this ready to be merged?

#27 Updated by Alexandru Lungu 11 months ago

Lorian, please test this task according to Customer_Test_Plan_Tracking

#28 Updated by Lorian Sandu 11 months ago

I have already tested this and it passed.

#29 Updated by Teodor Gorghe 11 months ago

I think it can be merged to trunk

#30 Updated by Constantin Asofiei 10 months ago

  • Status changed from Internal Test to Merge Pending

Teodor, please merge 9448a now.

#31 Updated by Teodor Gorghe 10 months ago

  • Status changed from Merge Pending to Test

Branch 9448a was merged to trunk rev 16195 and archived.

#32 Updated by Constantin Asofiei 10 months ago

  • Status changed from Test to Closed

#34 Updated by Alexandru Lungu 7 months ago

  • Related to Bug #11042: NativeInvoker may generate memptr with unknown size added

#35 Updated by Teodor Gorghe 6 months ago

  • Related to Bug #11149: DO i = 1 TO LENGTH(r, "RAW") converts to incompatible type expression added

Also available in: Atom PDF