Part of dotnet/corefx#4278.
The goal is to write automated tests for the System.Security.Cryptography.Xml namespace such that it can be incorporated into the corefx libraries.
There is no articulated quality bar, like a code coverage percentage. However, there is an implicit high bar for the quality set for corefx. This is security sensitive so additional testing of possible attacks and ensuring no foreseeable vulnerabilities is required.
The tests should ensure the code complies with the spec. It should also revisit the changes introduced in MS16-035. Details on the spec and security advisory will be added later.
There is no deadline or other requirements.
Please contact @tintoy or @anthonylangsworth if you have questions. Participation by others is welcome and encouraged. To avoid duplication of effort, please reach out to @tintoy and @anthonylangsworth before doing so.
Methodology
Use the feature/xml-crypto/tests branch as a starting point for your work; the projects in this branch have been modified so that tests can be built and run.
To run tests:
- Build CoreFx on Windows.
- Load the solution file
src\System.Security.Cryptography.Xml\System.Security.Cryptography.Xml.sln in Visual Studio 2015 SP 1 or later, set the System.Security.Cryptograpy.Xml.Tests project as the startup project and hit Ctrl+F5.
Tests:
- must be written using xUnit, as per the standard for .Net core.
- must follow the C# Coding style guidelines.
- should ensure the corefx version follows the behavior of the existing
System.Security.Cryptography.Xml namespace. If this is not possible, such as from missing dependencies or platform differences, please raise this for further discussion with @tintoy and @anthonylangsworth.
- must be committed to the branch via pull request so it can be reviewed. The goal is to get multiple eyes on the tests to ensure we meet our goal and share understanding.
- must pass.
Test Plan
Creation of automated tests follows two phases:
- Writing tests that cover all exposed public classes and methods. The goal is to ensure all exposed methods and properties of all classes work.
- Drill into use of
SignedXml to ensure it meets the standard, effectively integration and security tests. This builds upon the foundation of the previous phase with the confidence that the supporting classes work.
Phase 1 (Unit Testing)
The following table lists the public classes exposed by the System.Security.Cryptography.Xml namespace. These will be checked off once the tests are completed and reviewed.
As stated above, if you wish to contribute, please reach out to @tintoy and @anthonylangsworth to avoid duplication of effort.
Phase 2 (Spec and Integration Testing)
TBA once we pass phase 1.
Questions
Part of dotnet/corefx#4278.
The goal is to write automated tests for the
System.Security.Cryptography.Xmlnamespace such that it can be incorporated into the corefx libraries.There is no articulated quality bar, like a code coverage percentage. However, there is an implicit high bar for the quality set for corefx. This is security sensitive so additional testing of possible attacks and ensuring no foreseeable vulnerabilities is required.
The tests should ensure the code complies with the spec. It should also revisit the changes introduced in
MS16-035. Details on the spec and security advisory will be added later.There is no deadline or other requirements.
Please contact @tintoy or @anthonylangsworth if you have questions. Participation by others is welcome and encouraged. To avoid duplication of effort, please reach out to @tintoy and @anthonylangsworth before doing so.
Methodology
Use the feature/xml-crypto/tests branch as a starting point for your work; the projects in this branch have been modified so that tests can be built and run.
To run tests:
src\System.Security.Cryptography.Xml\System.Security.Cryptography.Xml.slnin Visual Studio 2015 SP 1 or later, set the System.Security.Cryptograpy.Xml.Tests project as the startup project and hit Ctrl+F5.Tests:
System.Security.Cryptography.Xmlnamespace. If this is not possible, such as from missing dependencies or platform differences, please raise this for further discussion with @tintoy and @anthonylangsworth.Test Plan
Creation of automated tests follows two phases:
SignedXmlto ensure it meets the standard, effectively integration and security tests. This builds upon the foundation of the previous phase with the confidence that the supporting classes work.Phase 1 (Unit Testing)
The following table lists the public classes exposed by the
System.Security.Cryptography.Xmlnamespace. These will be checked off once the tests are completed and reviewed.As stated above, if you wish to contribute, please reach out to @tintoy and @anthonylangsworth to avoid duplication of effort.
Phase 2 (Spec and Integration Testing)
TBA once we pass phase 1.
Questions
InternalsVisibleToto get access to the internal classes? It will certainly make testing easier but risks possible exploitation.