Commit 06daba75 authored by Robert Speicher's avatar Robert Speicher
Browse files

Merge branch 'evn-add-neg-tests' into 'master'

Test for what should not be there as well

[ci skip]

See merge request gitlab-org/gitlab-ce!14492
......@@ -150,6 +150,16 @@ always in-sync with the codebase.
[GitLab QA]:
[part of GitLab Rails]:
## Test for what should not be there
This is particularly important for permission calls and might be called a
negative assertion: make sure only the bare minimum is returned and nothing else.
See an issue about [leaking tokens] as an example of a vulnerability that is
captured by such a test.
[leaking tokens]:
## How to test at the correct level?
As many things in life, deciding what to test at each level of testing is a
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment