5 ms·

For a list of strings that often cause problems to, e.g., add to a test suite, see https://github.com/minimaxir/big-list-of-naughty-strings https://github.com/m

For a list of strings that often cause problems to, e.g., add to a test suite, see https://github.com/minimaxir/big-list-of-naughty-strings https://github.com/minimaxir/big-list-of-naughty-strings

Dunedan 5y ago
For finding bugs caused by unexpected inputs I also find property based testing very useful. For Python there is the excellent hypothesis library for doing that: https://hypothesis.readthedocs.io/en/latest/ https://hypothesis.readthedocs.io/en/latest/
ryanianian 5y ago
Very handy. My previous simple test-case was simply a selection from this well-known text-file which is simply a collection of somewhat uncommon unicode characters, usually used for rendering tests. https://www.cl.cam.ac.uk/~mgk25/ucs/examples/UTF-8-demo.txt https://www.cl.cam.ac.uk/~mgk25/ucs/examples/UTF-8-demo.txt But this set of strings is specifically designed to cause edge-case errors. Also don't forget Spolsky's seminal "The Absolute Minimum Every Software Developer Absolutely, Positively Must Know About Unicode and Character Sets (No Excuses!)". https://www.joelonsoftware.com/2003/10/08/the-absolute-minimum-every-software-developer-absolutely-positively-must-know-about-unicode-and-character-sets-no-excuses/ https://www.joelonsoftware.com/2003/10/08/the-absolute-minim...
OskarS 5y ago
An enormously useful list, I’ve used it several times, and it can often dig up some real nastiness if you haven’t been super careful. This entry, by the way, is a fantastic little easter egg in the list: https://github.com/minimaxir/big-list-of-naughty-strings/blob/db33ec7b1d5d9616a88c76394b7d0897bd0b97eb/blns.txt#L712 https://github.com/minimaxir/big-list-of-naughty-strings/blo...
- vertis 5y ago
  No, seriously, wake up
  - deleted 5y ago
    [deleted]
  - jamiek88 5y ago
    That was creepy!
munk-a 5y ago
It's also important to width-test fields. Never forget to make sure that WWWWWWWWWWWW doesn't cause weird application wrapping.
- aidenn0 5y ago
  I used a system where the maximum length on the "new password" field in the change password form was longer than the password field in the login form. The symptom was that I could login if I used my password manager browser plugin, but not if I pasted it from my password manager.
  - joe_guy 5y ago
    Not fully related but you reminded me of this. Around the time of AOL3 or early AOL4 someone found a user name exploit. When making a new account, on the client side use winapi's EM_LIMITTEXT to bypass the max character limit on the input textbox. Enter one or two letters, a bunch of spaces, then some more letters. The server side would truncate to the original length, leaving you with a one or two letter username, working around the 3+ requirement.
  - TechieKid 5y ago
    Discover (discover.com) currently has a similar bug where it'll allow me to login with my password, but will not accept the same password in the 'Change password' workflow as the old password, complaining about it being invalid. (shrug)
  - kevinmgranger 5y ago
    You're lucky they weren't different lengths in the backend. I've been bitten by that surprise one too many times (which is any number higher than zero)
    - a1369209993 5y ago
      > one too many times (which is any number higher than zero) Nitpick: if the number is higher than one, then it's at least two times too many.
tomaslaureano 5y ago
Great resource! I usually use pangrams (holoalphabetic sentences like "The quick brown fox jumps over the lazy dog") to ensure that my code can handle all the alphabet characters for the languages that should be supported at the very minimum.

For a list of strings that often cause problems to, e.g., add to a test suite, see https://github.com/minimaxir/big-list-of-naughty-strings https://github.com/minimaxir/big-list-of-naughty-strings

Dunedan 5y ago

For finding bugs caused by unexpected inputs I also find property based testing very useful. For Python there is the excellent hypothesis library for doing that: https://hypothesis.readthedocs.io/en/latest/ https://hypothesis.readthedocs.io/en/latest/

ryanianian 5y ago

Very handy. My previous simple test-case was simply a selection from this well-known text-file which is simply a collection of somewhat uncommon unicode characters, usually used for rendering tests. https://www.cl.cam.ac.uk/~mgk25/ucs/examples/UTF-8-demo.txt https://www.cl.cam.ac.uk/~mgk25/ucs/examples/UTF-8-demo.txt But this set of strings is specifically designed to cause edge-case errors. Also don't forget Spolsky's seminal "The Absolute Minimum Every Software Developer Absolutely, Positively Must Know About Unicode and Character Sets (No Excuses!)". https://www.joelonsoftware.com/2003/10/08/the-absolute-minimum-every-software-developer-absolutely-positively-must-know-about-unicode-and-character-sets-no-excuses/ https://www.joelonsoftware.com/2003/10/08/the-absolute-minim...

OskarS 5y ago

An enormously useful list, I’ve used it several times, and it can often dig up some real nastiness if you haven’t been super careful. This entry, by the way, is a fantastic little easter egg in the list: https://github.com/minimaxir/big-list-of-naughty-strings/blob/db33ec7b1d5d9616a88c76394b7d0897bd0b97eb/blns.txt#L712 https://github.com/minimaxir/big-list-of-naughty-strings/blo...

vertis 5y ago
No, seriously, wake up
- deleted 5y ago
  [deleted]
- jamiek88 5y ago
  That was creepy!

munk-a 5y ago

It's also important to width-test fields. Never forget to make sure that WWWWWWWWWWWW doesn't cause weird application wrapping.

aidenn0 5y ago
I used a system where the maximum length on the "new password" field in the change password form was longer than the password field in the login form. The symptom was that I could login if I used my password manager browser plugin, but not if I pasted it from my password manager.
- joe_guy 5y ago
  Not fully related but you reminded me of this. Around the time of AOL3 or early AOL4 someone found a user name exploit. When making a new account, on the client side use winapi's EM_LIMITTEXT to bypass the max character limit on the input textbox. Enter one or two letters, a bunch of spaces, then some more letters. The server side would truncate to the original length, leaving you with a one or two letter username, working around the 3+ requirement.
- TechieKid 5y ago
  Discover (discover.com) currently has a similar bug where it'll allow me to login with my password, but will not accept the same password in the 'Change password' workflow as the old password, complaining about it being invalid. (shrug)
- kevinmgranger 5y ago
  You're lucky they weren't different lengths in the backend. I've been bitten by that surprise one too many times (which is any number higher than zero)
  - a1369209993 5y ago
    > one too many times (which is any number higher than zero) Nitpick: if the number is higher than one, then it's at least two times too many.

tomaslaureano 5y ago

Great resource! I usually use pangrams (holoalphabetic sentences like "The quick brown fox jumps over the lazy dog") to ensure that my code can handle all the alphabet characters for the languages that should be supported at the very minimum.