DC tests don't validate certificates
- Dominant language
- Go
- Stars
- 370
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
In `delegated_credentials_test.go` `TestDCHandshakeServerAuth` sets `clientConfig.InsecureSkipVerify = true`. Because of how golang handles global state this is propagated to all later tests. This leads to test failures if the tests are run in a different order or individually.
This means that even if you put bit flips into the test certificate signatures the tests will still pass.
Contributor guide
Research direction
Start in delegated_credentials_test.go at TestDCHandshakeServerAuth and run the delegated-credentials tests individually and in different orders. Trace how clientConfig.InsecureSkipVerify affects later tests; done means certificate signature bit flips are rejected and test results do not depend on execution order.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security, testing-qa
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100