okkhoy
commented
1 year ago A very good question! Your understanding is correct. In the PE you can do both! The teams should manage data tampering in an elegant way. Some possible (but not exhaustive) things are:
- if there are n data elements and 1 is tampered, the application should recover the n-1 items
- if the data is tampered beyond limit (during execution), application should try to reinstitate the data based on the in-memory data
- if the data is tampered beyond limit (before startup), application can throw an error message and start afresh with no data If any of these are done then yo can think of it as "handled tampering"
Of course, you cannot expect the application to recover tampered data if it is not already read by the app and maintained in-memory.
@Than-Duc-Huy
I would like to ask about the extent of testing for the PE, especially for the storage files generated by the program For acceptance testing, we should behave like a user and should only do what was told in the UG. We shouldn't tamper with the storage files. But for system testing, we can tamper with the storage file to see how the program respond! Is my understanding correct? How do we know if the application has handle the tampering of the storage file elegantly so that we don't raise it as a bug!