主题： regression-testing
-
Testing that profile updates cannot assign privileged account fields
Create a narrow regression for updates that accept ordinary profile data alongside fields the caller must not control. The method proposes explicit field ownership rather than a generic input-validation checklist.
-
Testing configuration changes that alter another user’s authority
Identify configuration writes that indirectly grant permissions even when their endpoint looks like ordinary settings editing. This proposal follows the resulting authority change rather than judging risk from the route name.
-
Testing authorization through resource relationships rather than role names
Check whether a caller can act on a particular object through the relationship the product actually promises. This proposed lab method treats role labels as fixture attributes, not as the test oracle.
-
Defining the authorization oracle for mixed-object batch requests
Expose ambiguous access rules in batch operations before an agent writes tests that approve whichever response the implementation happens to return. The proposal focuses on mixed ownership within one request.
-
Checking adjacent access paths after a narrowly scoped security fix
Expand a regression just enough to test whether a repaired policy boundary is shared by neighboring paths. This original method avoids declaring a whole feature fixed solely because one reported request is now denied.
机器可读： JSON