Add TestIsWeakHashAlgo tests for is_weak_hash_algo() in ssl.py#1452
Add TestIsWeakHashAlgo tests for is_weak_hash_algo() in ssl.py#1452Raavi29 wants to merge 13 commits intoOWASP:masterfrom
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughExpanded parametrized test cases in Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
tests/core/lib/test_ssl.py (1)
575-623: Good test coverage foris_weak_hash_algo().The new tests add valuable coverage for RSA suffix variants, case insensitivity, additional safe algorithms (sha384, sha512), and edge cases. The docstring and section comments are helpful.
Note that there's an existing parameterized test at lines 457-469 in
TestSslMethodthat covers basic cases. Consider consolidating by extending that parameterized test with your new cases, which would reduce duplication and keep related tests together:`@pytest.mark.parametrize`( "algo,expected", [ # Weak algorithms ("md2", True), ("md4", True), ("md5", True), ("sha1", True), ("sha1WithRSAEncryption", True), ("md5WithRSAEncryption", True), ("SHA1WithRSAEncryption", True), # case insensitivity ("MD5WithRSAEncryption", True), # Safe algorithms ("sha256", False), ("sha256WithRSAEncryption", False), ("sha384WithRSAEncryption", False), ("sha512WithRSAEncryption", False), # Edge cases ("", False), ("someRandomAlgorithm", False), ], ) def test_is_weak_hash_algo(self, algo, expected): assert is_weak_hash_algo(algo) == expectedHowever, keeping a separate class for organizational clarity is also acceptable.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@tests/core/lib/test_ssl.py` around lines 575 - 623, The new TestIsWeakHashAlgo tests duplicate coverage of is_weak_hash_algo already parameterized in TestSslMethod; update the existing pytest.mark.parametrize in TestSslMethod to include the RSA-suffix, case-insensitive, safe-algorithm and edge-case tuples (e.g., ("sha1WithRSAEncryption", True), ("md5WithRSAEncryption", True), ("SHA1WithRSAEncryption", True), ("MD5WithRSAEncryption", True), ("sha384WithRSAEncryption", False), ("sha512WithRSAEncryption", False), ("", False), ("someRandomAlgorithm", False)) and then remove or collapse the separate TestIsWeakHashAlgo class to avoid duplication while keeping the same assertions (assert is_weak_hash_algo(algo) == expected).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@tests/core/lib/test_ssl.py`:
- Around line 622-623: The file ends without a trailing newline; open
tests/core/lib/test_ssl.py and add a single newline character at the end of the
file (after the closing line containing the test_random_string_is_not_weak
assertion) so the file terminates with a newline; no code changes to functions
(is_weak_hash_algo or test_random_string_is_not_weak) are required—just ensure
the EOF has a newline.
---
Nitpick comments:
In `@tests/core/lib/test_ssl.py`:
- Around line 575-623: The new TestIsWeakHashAlgo tests duplicate coverage of
is_weak_hash_algo already parameterized in TestSslMethod; update the existing
pytest.mark.parametrize in TestSslMethod to include the RSA-suffix,
case-insensitive, safe-algorithm and edge-case tuples (e.g.,
("sha1WithRSAEncryption", True), ("md5WithRSAEncryption", True),
("SHA1WithRSAEncryption", True), ("MD5WithRSAEncryption", True),
("sha384WithRSAEncryption", False), ("sha512WithRSAEncryption", False), ("",
False), ("someRandomAlgorithm", False)) and then remove or collapse the separate
TestIsWeakHashAlgo class to avoid duplication while keeping the same assertions
(assert is_weak_hash_algo(algo) == expected).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: bf035ee3-8d3c-4105-9fdb-c077c737c629
📒 Files selected for processing (1)
tests/core/lib/test_ssl.py
- 14 tests covering: expired cert, valid cert, self-signed detection, date format validation, key presence, expiring_soon logic - Uses cryptography library to generate fake certs — no network required - ssl.py coverage: 15% to 17% - Addresses CodeRabbit feedback from PR OWASP#1452
Addresses CodeRabbit feedback on PR OWASP#1487 - all previous weak hash tests had the weak token at the start of the string. This test confirms is_weak_hash_algo uses 'in' not 'startswith', so weak tokens are detected anywhere in the algorithm string.
|
Latest commit adds a test for weak algo not at start of string (rsaWithSHA1Encryption) - addresses CodeRabbit suggestion about non-prefix cases. |
There was a problem hiding this comment.
Pull request overview
Adds additional unit tests for is_weak_hash_algo() (in nettacker/core/lib/ssl.py) to improve coverage around algorithm string variants, casing, and edge inputs.
Changes:
- Appends a new
TestIsWeakHashAlgotest class covering weak/safe algorithm variants and case-insensitivity. - Adds edge-case tests for empty and unrecognized algorithm strings.
- Minor reordering within the
from nettacker.core.lib.ssl import (...)list.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@Raavi29 PRs unsigned commits will not be accepted |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
tests/core/lib/test_ssl.py (1)
466-472: New parametrized cases look correct and align with the implementation.The added cases exercise case-insensitivity (
SHA1WithRSAEncryption,MD5WithRSAEncryption), non-prefix substring matches for MD2/MD4/MD5/SHA1 within realistic OID-style names, and a safe boundary (sha256WithRSAEncryption). All expected values match the substring-based, lowercased check inis_weak_hash_algo(nettacker/core/lib/ssl.py:13-18).Optional: the PR description mentions empty-string and random-string edge cases — consider also adding
("", False)and e.g.("random_string", False)here so they live in the same parametrize list rather than as separate tests. Not blocking.♻️ Optional additions
("sha256WithRSAEncryption", False), + ("", False), + ("random_string", False),🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@tests/core/lib/test_ssl.py` around lines 466 - 472, Add the two optional edge-case parametrized inputs suggested by the reviewer to the same parametrize list so they live with the other hash-name test cases: include ("", False) and ("random_string", False) alongside the existing entries that test is_weak_hash_algo (the substring-based, lowercased check implemented in nettacker/core/lib/ssl.py); update the parameter tuple list in tests/core/lib/test_ssl.py where the current cases (e.g., "md2WithRSAEncryption", "sha256WithRSAEncryption", "MD5WithRSAEncryption") are defined so these two new entries are covered by the same test function.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@tests/core/lib/test_ssl.py`:
- Around line 466-472: Add the two optional edge-case parametrized inputs
suggested by the reviewer to the same parametrize list so they live with the
other hash-name test cases: include ("", False) and ("random_string", False)
alongside the existing entries that test is_weak_hash_algo (the substring-based,
lowercased check implemented in nettacker/core/lib/ssl.py); update the parameter
tuple list in tests/core/lib/test_ssl.py where the current cases (e.g.,
"md2WithRSAEncryption", "sha256WithRSAEncryption", "MD5WithRSAEncryption") are
defined so these two new entries are covered by the same test function.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: a8bbf1e4-82ca-4db0-aa32-b57a757db1ff
📒 Files selected for processing (1)
tests/core/lib/test_ssl.py
@securestep9 Duly noted. |
Proposed change
Summary
Adds 11 unit tests for
is_weak_hash_algo()innettacker/core/lib/ssl.pyas a newTestIsWeakHashAlgoclass appended to the existing test suite.What was tested
Notes
is_weak_hash_algo()coverage: 0% -> 15% on nettacker/core/lib/ssl.pyType of change
Checklist
make pre-commitand confirm it didn't generate any warnings/changesmake test, I confirm all tests passed locallydocs/folder