Day 116 — Test Coverage Audit

Exercise — Coverage Audit + Gap-Filling

# Run coverage for all packages
go test -coverprofile=coverage.out ./...
go tool cover -func=coverage.out | sort -k3 -rn | head -20

# Generate HTML report to see exact uncovered lines
go tool cover -html=coverage.out -o coverage.html

# Focus on security-critical packages
go test -coverprofile=waf.out ./internal/waf/...
go tool cover -func=waf.out

Coverage targets:

Negative path tests to add (examples):

// WAF tests — negative paths that must be covered
func TestWAF_SQLiBypassAttempts(t *testing.T) {
    cases := []struct {
        name    string
        input   string
        blocked bool
    }{
        {"url_encoded_sqli", "%27+OR+%271%27%3D%271", true},
        {"double_encoded_sqli", "%2527+OR+1%3D1", true},
        {"comment_obfuscation", "1/**/OR/**/1=1", true},
        {"case_variation", "SeLeCt * FrOm users", true},
        {"normal_search", "SELECT the best laptop", false}, // legitimate
        {"sql_in_product_name", "SQL Server 2019 License", false}, // legitimate
    }
    // ...
}

// Auth tests — negative paths
func TestAuth_RejectExpiredToken(t *testing.T) { /* ... */ }
func TestAuth_RejectTamperedSignature(t *testing.T) { /* ... */ }
func TestAuth_RejectReplayedToken(t *testing.T) { /* ... */ }
func TestAuth_TimingConsistency(t *testing.T) {
    // Auth rejection should take same time as acceptance (within 10ms)
    validStart := time.Now()
    authMiddleware.ServeHTTP(rec, validReq)
    validTime := time.Since(validStart)

    invalidStart := time.Now()
    authMiddleware.ServeHTTP(rec2, invalidReq)
    invalidTime := time.Since(invalidStart)

    delta := validTime - invalidTime
    if delta < 0 { delta = -delta }
    if delta > 10*time.Millisecond {
        t.Errorf("auth timing difference %v > 10ms — potential timing oracle", delta)
    }
}