Repository navigation
Conversation
Add unit tests for sha256Hash() and safeEqual() covering output format, determinism, equal/different strings, and different-length inputs. Also fix a latent bug in safeEqual(): zero-padding the shorter buffer before the constant-time comparison made strings that only differ by trailing NUL bytes (e.g. "abc" vs "abc\0") compare as equal. safeEqual now explicitly returns false whenever the original lengths differ.
|
@Martha-code-dev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR was scoped to batch unit test additions for #591, #592, #599, and #600. On investigation, #591 (certificate utilities), #592 (accessibility checker), and #600 (sanitize utility) already have thorough, passing unit test coverage on
main(tests/unit/credentials/certificate-urls.test.ts,tests/unit/credentials/completion-certificate.test.ts,tests/unit/courses/accessibility.test.ts,tests/unit/utils/sanitize.test.ts) — each covers the acceptance criteria listed in its issue. Only #599 (crypto utility) had no test file, so this PR adds that coverage and fixes a latent correctness bug it uncovered.closes #599
closes #591
closes #592
closes #600
Changes
tests/unit/utils/crypto.test.tscoveringsha256Hash()(hex format, length, determinism, distinct inputs, a known test vector, unicode input) andsafeEqual()(equal strings, differing strings, differing lengths, prefix strings, empty strings, case sensitivity). While writing the different-length cases, found thatsafeEqual()zero-pads both buffers before the constant-time comparison, which made strings differing only by trailing NUL bytes (e.g."abc"vs"abc\0") compare as equal. Fixedsrc/utils/crypto.tssosafeEqual()always returnsfalsewhen the original (unpadded) lengths differ, while still running a constant-time comparison on the padded buffers so timing doesn't leak the length mismatch.Not included
main; no new test file was needed, so no code changes are included for these and they are not markedcloseshere. Flagging in case the maintainers want these issues closed as duplicates/already-done.Test plan
npx vitest run tests/unit/utils/crypto.test.ts— 13/13 passing, including the NUL-byte regression case.npx vitest run tests/unit/utils/crypto.test.ts tests/unit/utils/sanitize.test.ts tests/unit/credentials/certificate-urls.test.ts tests/unit/credentials/completion-certificate.test.ts tests/unit/courses/accessibility.test.ts— 40/40 passing (confirms thesafeEqualfix doesn't regress anything these other suites touch).vitest runon this branch shows 71 pre-existing failing test files unrelated to this change (a brokenlogger.debugmock affecting many service tests onmainalready); none are in the files touched by this PR.Happy to split the "Not included" findings into separate comments on #591/#592/#600 if that's preferred over noting them here.