heiko/mailseal
heiko/mailseal
Watch
1
0
Fork
You've already forked mailseal
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

tests: cover signing, verification, cancellation, and untrusted-input parsers #10

New issue
Closed
opened 2026-07-21 17:20:20 +02:00 by heiko · 0 comments
heiko commented 2026-07-21 17:20:20 +02:00
Owner
Copy link

Problem

The repository has no direct tests for sign or verify, even though they contain the trust decision, concurrency, wire-format creation, and output routing. Existing tests cover normalization, query generation, local TCP transport, and response formatting, but not end-to-end security invariants.

The custom RFC 5322 parser and x-signature JSON/token decoder consume attacker-controlled input and currently have no fuzz tests. Race testing passes only because the untested signing concurrency is not exercised.

Checklist: #82 (separate deterministic tests from integrations), #83 (race testing), #90 (use testing facilities); also Go fuzzing guidance.

Proposed test architecture

  • Inject a consumer-side Timestamper factory so sign tests use deterministic fakes/httptest, never public TSAs.
  • Add trusted and untrusted TSA fixtures with a local CA.
  • Cover output formats: message, header, token, response.
  • Cover malformed/failed TSA responses, all-TSAs-fail, mixed outcomes, cancellation, timeout, and --max boundaries.
  • Verify no output is emitted before a response passes all required checks.
  • Test verification for no header, malformed JSON/base64/ASN.1, unsupported version, field-policy changes, message tampering, bad chain, and valid chain.
  • Fuzz rfc822.Parse, canonicalization, header JSON decoding, and token chunk reassembly with bounded inputs.
  • Run go test -race -shuffle=on ./... in CI.

Acceptance criteria

  • Security-critical success and failure branches have deterministic tests.
  • No test contacts a public TSA.
  • At least one parser fuzz target and one signature-header fuzz target are checked in with seed corpus entries.
  • Race/shuffle testing is documented or automated.

Reviewed against 948b7a9 on master (Go 1.26.2).

## Problem The repository has no direct tests for `sign` or `verify`, even though they contain the trust decision, concurrency, wire-format creation, and output routing. Existing tests cover normalization, query generation, local TCP transport, and response formatting, but not end-to-end security invariants. The custom RFC 5322 parser and `x-signature` JSON/token decoder consume attacker-controlled input and currently have no fuzz tests. Race testing passes only because the untested signing concurrency is not exercised. Checklist: #82 (separate deterministic tests from integrations), #83 (race testing), #90 (use testing facilities); also Go fuzzing guidance. ## Proposed test architecture - Inject a consumer-side `Timestamper` factory so sign tests use deterministic fakes/`httptest`, never public TSAs. - Add trusted and untrusted TSA fixtures with a local CA. - Cover output formats: message, header, token, response. - Cover malformed/failed TSA responses, all-TSAs-fail, mixed outcomes, cancellation, timeout, and `--max` boundaries. - Verify no output is emitted before a response passes all required checks. - Test verification for no header, malformed JSON/base64/ASN.1, unsupported version, field-policy changes, message tampering, bad chain, and valid chain. - Fuzz `rfc822.Parse`, canonicalization, header JSON decoding, and token chunk reassembly with bounded inputs. - Run `go test -race -shuffle=on ./...` in CI. ## Acceptance criteria - Security-critical success and failure branches have deterministic tests. - No test contacts a public TSA. - At least one parser fuzz target and one signature-header fuzz target are checked in with seed corpus entries. - Race/shuffle testing is documented or automated. Reviewed against `948b7a9` on `master` (Go 1.26.2).
heiko closed this issue 2026-07-22 11:18:25 +02:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
nagonag/update-master
svg
dev
No results found.
Labels
Clear labels   
nagonag
Automated dependency scan finding

  
nagonag/ignore
Ignore this nagonag finding

No labels
nagonag
nagonag/ignore
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
heiko/mailseal#10
No description provided.