Closed mvondracek closed 4 years ago
isinstance
can check, matching type but when programmed overrides/replaces methods.Validation of internal resources, testing with mocking ResourceManager. 064bad28e8ebd6fb93ba8493a0a8aa5ab53e58d0
Fuzzing mnemonic, seed, entropy, password with radamsa
Testing divided to: doctest, unit tests, integration tests, reference tests. + fuzzing
Code analysis tools incorporated to our CI pipeline:
Code coverage analysis:
Python package with installation, package data, and CLI tool.
Validation of inputs (maybe taint analysis?) using instantiation. After reading from user/files and until instantiation of our classes, data are consideres insecure. Later, when we are dealing with instances of our classes, data are considered secure.
Example of package usage (API) from generated docs (sphinx). Example, how our typechecking is more like better UX for programmers, but in Python, programmer could always create broken instance inherited from our class, which would sys.exit(1)
after any our method gets called.
Notes for final presentation of our secure development project:
master
anddev
branches are protected and require 2 approving pull request reviews