hyperscale-stack / security / 38015644582

94%

master: 97%

Pull #92

github

test(oauth2): pin the missing code_verifier description

TestAuthorizationCodeMissingVerifier only asserted invalid_grant, so
moving the missing-verifier check after the RFC 7636 syntax check went
unnoticed: an absent code_verifier then reads "malformed code_verifier"
instead of "missing code_verifier", with the same error code. Mutation
testing of the PKCE syntax fix left that mutant alive.

The test now pins the description, so the presence check keeps
answering before the syntax check. Refs #79.

46 of 46 new or added lines in 3 files covered. (100.0%)

4675 of 4950 relevant lines covered (94.44%)

75.16 hits per line