Add comprehensive security tests for OWASP A03 (Injection) and A10 (SSRF)
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
AOC Guard CI / aoc-guard (push) Has been cancelled
AOC Guard CI / aoc-verify (push) Has been cancelled

- Implemented InjectionTests.cs to cover various injection vulnerabilities including SQL, NoSQL, Command, LDAP, and XPath injections.
- Created SsrfTests.cs to test for Server-Side Request Forgery (SSRF) vulnerabilities, including internal URL access, cloud metadata access, and URL allowlist bypass attempts.
- Introduced MaliciousPayloads.cs to store a collection of malicious payloads for testing various security vulnerabilities.
- Added SecurityAssertions.cs for common security-specific assertion helpers.
- Established SecurityTestBase.cs as a base class for security tests, providing common infrastructure and mocking utilities.
- Configured the test project StellaOps.Security.Tests.csproj with necessary dependencies for testing.
This commit is contained in:
master
2025-12-16 13:11:57 +02:00
parent 5a480a3c2a
commit b55d9fa68d
72 changed files with 8051 additions and 71 deletions

View File

@@ -0,0 +1,44 @@
{
"$schema": "https://raw.githubusercontent.com/stryker-mutator/stryker-net/master/src/Stryker.Core/Stryker.Core/config-schema.json",
"stryker-config": {
"project-info": {
"name": "StellaOps.Authority",
"module": "Authority.Core",
"version": "0.0.1"
},
"solution": "../../StellaOps.Router.slnx",
"project": "StellaOps.Authority.csproj",
"test-projects": [
"../__Tests/StellaOps.Authority.Tests/StellaOps.Authority.Tests.csproj"
],
"reporters": [
"html",
"json",
"progress"
],
"thresholds": {
"high": 90,
"low": 75,
"break": 65
},
"mutation-level": "Advanced",
"mutators": {
"included": [
"Arithmetic",
"Boolean",
"Comparison",
"Conditional",
"Equality",
"Logical",
"NullCoalescing",
"String"
]
},
"coverage-analysis": "perTest",
"excluded-files": [
"**/Generated/**/*",
"**/Migrations/**/*"
],
"output-path": "../../.stryker/output/authority"
}
}