daml/security-evidence.md

Security tests, by category

Authorization:

• badly-authorized create is rejected: AuthorizationSpec.scala
• badly-authorized exercise is rejected: AuthorizationSpec.scala
• badly-authorized exercise/create (create is unauthorized) is rejected: AuthPropagationSpec.scala
• badly-authorized exercise/create (exercise is unauthorized) is rejected: AuthPropagationSpec.scala
• badly-authorized exercise/exercise (no implicit authority from outer exercise) is rejected: AuthPropagationSpec.scala
• badly-authorized fetch is rejected: AuthorizationSpec.scala
• badly-authorized lookup is rejected: AuthorizationSpec.scala
• create with no signatories is rejected: AuthorizationSpec.scala
• create with non-signatory maintainers is rejected: AuthorizationSpec.scala
• exercise with no controllers is rejected: AuthorizationSpec.scala
• well-authorized create is accepted: AuthorizationSpec.scala
• well-authorized exercise is accepted: AuthorizationSpec.scala
• well-authorized exercise/create is accepted: AuthPropagationSpec.scala
• well-authorized exercise/exercise is accepted: AuthPropagationSpec.scala
• well-authorized fetch is accepted: AuthorizationSpec.scala
• well-authorized lookup is accepted: AuthorizationSpec.scala

Privacy:

• ensure correct privacy for create node: BlindingSpec.scala
• ensure correct privacy for exercise node (consuming): BlindingSpec.scala
• ensure correct privacy for exercise node (non-consuming): BlindingSpec.scala
• ensure correct privacy for exercise subtree: BlindingSpec.scala
• ensure correct privacy for fetch node: BlindingSpec.scala
• ensure correct privacy for lookup-by-key node (found): BlindingSpec.scala
• ensure correct privacy for lookup-by-key node (not-found): BlindingSpec.scala
• ensure correct privacy for rollback subtree: BlindingSpec.scala

Semantics:

• Evaluation order of create with authorization failure: EvaluationOrderTest.scala
• Evaluation order of create with contract ID in contract key: EvaluationOrderTest.scala
• Evaluation order of create with contract key exceeding max nesting: EvaluationOrderTest.scala
• Evaluation order of create with create argument exceeding max nesting: EvaluationOrderTest.scala
• Evaluation order of create with duplicate contract key: EvaluationOrderTest.scala
• Evaluation order of create with empty contract key maintainers: EvaluationOrderTest.scala
• Evaluation order of create with failed precondition: EvaluationOrderTest.scala
• Evaluation order of fetch of a cached global contract with authorization failure: EvaluationOrderTest.scala
• Evaluation order of fetch of a cached global contract with failure authorization: EvaluationOrderTest.scala
• Evaluation order of fetch of a non-cached global contract with authorization failure: EvaluationOrderTest.scala
• Evaluation order of fetch of a non-cached global contract with failure authorization: EvaluationOrderTest.scala
• Evaluation order of fetch of a wrongly type cached global contract: EvaluationOrderTest.scala
• Evaluation order of fetch of a wrongly type non-cached global contract: EvaluationOrderTest.scala
• Evaluation order of fetch of an inactive global contract: EvaluationOrderTest.scala
• Evaluation order of fetch of an inactive local contract: EvaluationOrderTest.scala
• Evaluation order of fetch of an unknown contract: EvaluationOrderTest.scala
• Evaluation order of fetch of an wrongly typed local contract: EvaluationOrderTest.scala
• Evaluation order of fetch of cached global contract with failure authorization: EvaluationOrderTest.scala
• Evaluation order of fetch_by_key of an inactive global contract: EvaluationOrderTest.scala
• Evaluation order of fetch_by_key of an inactive global contract: EvaluationOrderTest.scala
• Evaluation order of fetch_by_key of an unknown contract key: EvaluationOrderTest.scala
• Evaluation order of fetch_by_key with contract ID in contract key: EvaluationOrderTest.scala
• Evaluation order of fetch_by_key with contract key exceeding max nesting: EvaluationOrderTest.scala
• Evaluation order of fetch_by_key with empty contract key maintainers: EvaluationOrderTest.scala
• Evaluation order of successful create: EvaluationOrderTest.scala
• Evaluation order of successful fetch of a cached global contract: EvaluationOrderTest.scala
• Evaluation order of successful fetch of a local contract: EvaluationOrderTest.scala
• Evaluation order of successful fetch of a non-cached global contract: EvaluationOrderTest.scala
• Evaluation order of successful fetch_by_key of a cached global contract: EvaluationOrderTest.scala
• Evaluation order of successful fetch_by_key of a local contract: EvaluationOrderTest.scala
• Evaluation order of successful fetch_by_key of a non-cached global contract: EvaluationOrderTest.scala
• Exceptions, throw/catch.: ExceptionTest.scala
• contract key behaviour (non-unique mode): ContractKeySpec.scala
• contract key behaviour (unique mode): ContractKeySpec.scala
• contract keys must have a non-empty set of maintainers: ContractKeySpec.scala
• contract keys should be evaluated after ensure clause: ContractKeySpec.scala
• contract keys should be evaluated only when executing create: ContractKeySpec.scala

Performance:

• Tail call optimization: Tail recursion does not blow the scala JVM stack.: TailCallTest.scala

Input Validation:

• ensure builtin operators have the correct type: TypingSpec.scala
• ensure expression forms have the correct type: TypingSpec.scala
• ill-formed create command is rejected: CommandPreprocessorSpec.scala
• ill-formed create-and-exercise command is rejected: CommandPreprocessorSpec.scala
• ill-formed exception definitions are rejected: TypingSpec.scala
• ill-formed exercise command is rejected: CommandPreprocessorSpec.scala
• ill-formed exercise-by-key command is rejected: CommandPreprocessorSpec.scala
• ill-formed expressions are rejected: TypingSpec.scala
• ill-formed fetch command is rejected: CommandPreprocessorSpec.scala
• ill-formed fetch-by-key command is rejected: CommandPreprocessorSpec.scala
• ill-formed interfaces are rejected: TypingSpec.scala
• ill-formed kinds are rejected: TypingSpec.scala
• ill-formed lookup command is rejected: CommandPreprocessorSpec.scala
• ill-formed records are rejected: TypingSpec.scala
• ill-formed templates are rejected: TypingSpec.scala
• ill-formed type synonyms applications are rejected: TypingSpec.scala
• ill-formed type synonyms definitions are rejected: TypingSpec.scala
• ill-formed types are rejected: TypingSpec.scala
• ill-formed variants are rejected: TypingSpec.scala
• well formed create command is accepted: CommandPreprocessorSpec.scala
• well formed create-and-exercise command is accepted: CommandPreprocessorSpec.scala
• well formed exercise command is accepted: CommandPreprocessorSpec.scala
• well formed exercise-by-key command is accepted: CommandPreprocessorSpec.scala
• well formed fetch command is accepted: CommandPreprocessorSpec.scala
• well formed fetch-by-key command is accepted: CommandPreprocessorSpec.scala
• well formed lookup command is accepted: CommandPreprocessorSpec.scala