3 ms·

Don't these people have tests?

• purerandomness 5y ago
  Tests cannot prove the absence of bugs, ever.
  • WJW 5y ago
    Sure, but this was the presence of a bug. In a web framework you can easily have a test that fails when CSRF vulnerabilities are present. It's not some zeroday that has just been published, CSRF has been known for a very long time now. As a demo, here is a link to an 1100 line file full of such tests for the Rails framework: https://github.com/rails/rails/blob/main/actionpack/test/controller/request_forgery_protection_test.rb https://github.com/rails/rails/blob/main/actionpack/test/con...
• pictur 5y ago
  good question. obviously, such large libraries should have security tests independent of the existing tests.
  • purerandomness 5y ago
    They do, and the patch for this CVE adds a test case for this bug: https://github.com/symfony/symfony/commit/f0ffb775febdf07e57117aabadac96fa37857f50 https://github.com/symfony/symfony/commit/f0ffb775febdf07e57...