<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Staffan Malmgrens blogg &#187; mjukvarutestning</title>
	<atom:link href="http://blog.tomtebo.org/tag/mjukvarutestning/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.tomtebo.org</link>
	<description>Programmering, juridik, punkrock och andra trivialiteter</description>
	<lastBuildDate>Sun, 01 Jan 2012 14:51:08 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>Part 7: Regression testing</title>
		<link>http://blog.tomtebo.org/2004/12/19/lagennu_tech_7/</link>
		<comments>http://blog.tomtebo.org/2004/12/19/lagennu_tech_7/#comments</comments>
		<pubDate>Sun, 19 Dec 2004 22:59:00 +0000</pubDate>
		<dc:creator>staffan</dc:creator>
				<category><![CDATA[programming]]></category>
		<category><![CDATA[lagen.nu]]></category>
		<category><![CDATA[mjukvarutestning]]></category>
		<category><![CDATA[programmering]]></category>
		<category><![CDATA[python]]></category>

		<guid isPermaLink="false">http://newblog.tomtebo.org/programming/part_7__regression_testing.html</guid>
		<description><![CDATA[(A series of blog posts about the tech behind lagen.nu. Earlier parts are here: first, second, third, fourth, fifth and sixth) Like most developers that have been Test infected, I try to create regression tests whenever I can. A project &#8230; <a href="http://blog.tomtebo.org/2004/12/19/lagennu_tech_7/">Läs mer <span class="meta-nav">&#8594;</span></a>]]></description>
			<content:encoded><![CDATA[<p>(A series of blog posts about the tech behind <a href="http://lagen.nu/">lagen.nu</a>. Earlier parts are here: <a href="/programming/lagen.nu_tech_1.html">first</a>, <a href="/programming/lagen.nu_tech_2.html">second</a>, <a href="/programming/lagen.nu_tech_3.html">third</a>, <a href="/programming/lagen.nu_tech_4.html">fourth</a>, <a href="/programming/lagen.nu_tech_5.html">fifth</a> and <a href="/programming/lagen.nu_tech_6.html">sixth</a>) </p>
<p>
    Like most developers that have been <a href="http://c2.com/cgi/wiki?TestInfected">Test infected</a>, I<br />
    try to create regression tests whenever I can. A project like<br />
    lagen.nu, which has no GUI, no event handling, no databases, just<br />
    operations on text files, is really well suited for automated<br />
    regression testing.  However, when I started out, I didn&#8217;t do<br />
    test-first programming since I didn&#8217;t really have any idea of what<br />
    I was doing. As things solidified, I encountered a particular<br />
    section of the code that lended itself very nicely to regression<br />
    testing.
  </p>
<p>
    Now, when I say regression testing, I don&#8217;t neccesarily mean unit<br />
    testing. I&#8217;m not so concerned with testing classes at the method<br />
    level as my &#8221;API&#8221; is really document oriented; a particular text<br />
    document sent into the program should result in the return of a<br />
    particular XML document. Basically, there are only two methods<br />
    that I&#8217;m testing:
  </p>
<ul>
<li>The <tt>lawparser.parse()</tt> method: Given a section of law text,<br />
    returns the same section with all references marked up, as<br />
    described in part 5.</li>
<li><tt>Law._txt_to_xml()</tt>, which, given a entire law as plaintext,<br />
    returns the xml version, as described in part 4</li>
</ul>
<p>
    Since both these tests operate in the fashion &#8221;Send in really big<br />
    string, compare result with the expected other even bigger<br />
    string&#8221;, I found that pyunit didn&#8217;t work that well for me, as it&#8217;s<br />
    more centered around testing lots of methods in lots of classes,<br />
    where the testdata is so small that it&#8217;s comfortable having them<br />
    inside the test code.
  </p>
<p>
    Instead, I created my tests in the form of a bunch of text<br />
    files. For <tt>lawparser.parse</tt>, each file is just two paragraphs, the<br />
    first being the indata, and the second being the expected outdata:
  </p>
<pre>
    Vid &auml;ndring av en bolagsordning eller av en beviljad koncession
    g&auml;ller 3 &sect; eller 4 a &sect; i till&auml;mpliga delar.

    Vid &auml;ndring av en bolagsordning eller av en beviljad koncession
    g&auml;ller &lt;link section="3"&gt;3 &sect;&lt;/link&gt; eller &lt;link section="4a"&gt;4 a &sect;&lt;/link&gt; i till&auml;mpliga delar.
  </pre>
<p>
    The test runner then becomes trivial:
  </p>
<pre>
def runtest(filename,verbose=False,quiet=False):
    (test,answer) = open(filename).read().split("\n\n", 1)
    p = LawParser(test,verbose)
    res = p.parse()
    if res.strip() == answer.strip():
        print "Pass: %s" % filename
        return True
    else:
        print "FAIL: %s" % filename
        if not quiet:
            print "----------------------------------------"
            print "EXPECTED:"
            print answer
            print "GOT:"
            print res
            print "----------------------------------------"
            return False
  </pre>
<p>
    Similarly, the code to test <tt>Law._txt_to_xml()</tt> is also<br />
    pretty trivial. There are two differences: Since the indata is<br />
    larger and already split up in paragraphs, the indata and expected<br />
    result for a particular test is stored in separate files. This<br />
    also lets me edit the expected results file using <a href="http://www.thaiopensource.com/nxml-mode/">nXML mode</a> in<br />
    Emacs.
  </p>
<p>
    Comparing two XML documents is also a little trickier, in that<br />
    they can be equivalent, but still not match byte-for-byte (since<br />
    there can be semantically insignificant whitespace and similar<br />
    stuff). To avoid getting false alarms, I put both the expected<br />
    result file, as well as the actual result, trough tidy. This<br />
    ensures that their whitespacing will be equivalent, as well as<br />
    easy to read. Also, a good example of piping things to and from a<br />
    command in python:
  </p>
<pre>
def tidy_xml_string(xmlstring):
    """Neatifies a XML string and returns it"""
    (stdin,stdout) = os.popen2("tidy -q -n -xml --indent auto --char-encoding latin1")
    stdin.write(xmlstring)
    stdin.close()
    return stdout.read()
  </pre>
<p>
    If the two documents still don&#8217;t match, it can be difficult to<br />
    pinpoint the exact place where they match. I could dump the<br />
    results to file and run command-line diff on them, but since there<br />
    exists a perfectly good diff implementation in the python standard<br />
    libraries I used that one instead:
  </p>
<pre>
    from difflib import Differ
    differ = Differ()
    diff = list(differ.compare(res.splitlines(), answer.splitlines()))
    print "\n".join(diff)+"\n"
  </pre>
<p>
    The result is even easier to read than standard diff output, since<br />
    it points out the position on the line as well (maybe there&#8217;s a<br />
    command line flag for diff that does this?):
  </p>
<pre>
[...]
      suscipit non, venenatis ac, dictum ut, nulla. Praesent
      mattis.&lt;/p&gt;
    &lt;/section&gt;
-   &lt;section id="1" element="2"&gt;
?                   ^^^

+   &lt;section id="1" moment="2"&gt;
?                   ^^

      &lt;p&gt;Sed semper, ante non vehicula lobortis, leo urna sodales
      justo, sit amet mattis felis augue sit amet felis. Ut quis
[...]
  </pre>
<p>
    So, that&#8217;s basically my entire test setup for now. I need to build<br />
    more infrastructure for testing the XSLT transform and the HTML<br />
    parsing code, but these two areas are the trickiest.
  </p>
<p>
    Since I can run these test methods without having a expected<br />
    return value, they are very useful as the main way of developing<br />
    new functionality: I specify the indata, and let the test function<br />
    just print the outdata. I can then work on new functionality<br />
    without having to manually specifying exactly how I want the<br />
    outdata to look (because this is actually somewhat difficult for<br />
    large documents), I just hack away until it sort of looks like I<br />
    want, and then just cut&#8217;n paste the outdata to the &#8221;expected<br />
    result&#8221; file.
  </p>
]]></content:encoded>
			<wfw:commentRss>http://blog.tomtebo.org/2004/12/19/lagennu_tech_7/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Quickies of the day</title>
		<link>http://blog.tomtebo.org/2004/04/29/quickies_of_the_day-3/</link>
		<comments>http://blog.tomtebo.org/2004/04/29/quickies_of_the_day-3/#comments</comments>
		<pubDate>Wed, 28 Apr 2004 23:36:00 +0000</pubDate>
		<dc:creator>staffan</dc:creator>
				<category><![CDATA[programming]]></category>
		<category><![CDATA[abstraktioner]]></category>
		<category><![CDATA[datorsäkerhet]]></category>
		<category><![CDATA[mjukvarutestning]]></category>

		<guid isPermaLink="false">http://newblog.tomtebo.org/programming/quickies_of_the_day.html</guid>
		<description><![CDATA[Anil John writes about developing ASP.NET applications that run under Partial Trust. The whole Code Access Security framework in .Net is a complex beast, and I fear that most developers never will learn enough to actually use it properly, leaving &#8230; <a href="http://blog.tomtebo.org/2004/04/29/quickies_of_the_day-3/">Läs mer <span class="meta-nav">&#8594;</span></a>]]></description>
			<content:encoded><![CDATA[<ul>
<li>Anil John writes about developing ASP.NET applications that <a href="http://cyberforge.com/weblog/aniltj/archive/2004/04/27/486.aspx">run under Partial Trust</a>. The whole Code Access Security framework in .Net is a complex beast, and I fear that most developers never will learn enough to actually use it properly, leaving them with applications that appear to be secured against malicious in-process code, but still can be vulnerable to &#8221;luring attacks&#8221;. And if you let a single malicious assembly run with FullTrust, it&#8217;s Game over for your entire host process, as explained by Keith Brown in <a href="http://msdn.microsoft.com/msdnmag/issues/04/04/SecurityBriefs/">Beware of Fully Trusted Code</a>. As Anil says, chapter 6-9 in <a href="http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/ThreatCounter.asp">Improving Web Application Security: Threats and Countermeasures</a> is recommended reading. As a sidenote, are there any MVP&#8217;s that specialize in Code Access Security? </li>
<li>Tim Bray <a href="http://www.tbray.org/ongoing/When/200x/2004/04/26/WSTandP">writes</a> about the higher level web services specifications, and how the law of <a href="http://www.joelonsoftware.com/articles/LeakyAbstractions.html">leaky abstractions</a> work against them. <i>&#8221;[...]; applications that try to abstract away the fact that they&#8217;re exchanging XML messages will suffer for it&#8221;</i> </li>
<li>Anil Dash warns against <a href="http://www.dashes.com/anil/2004/04/28/learning_from_t">yet another scenario</a> where Word&#8217;s &#8221;Track Changes&#8221; feature can come back and bite you in the ass. I once recieved a press release in .doc format that had Track Changes enabled in such a way that they didn&#8217;t show up on screen, but did when you printed it. Oops indeed. </li>
<li>Jon Udell observes that developers still <a href="http://weblog.infoworld.com/udell/2004/04/26.html#a982">have a lot to learn</a> when it comes to internationalizing applications, and compares us with 13-th century French Artisans. I don&#8217;t think I have linked to Joel Spolsky&#8217;s excellent <a href="http://www.joelonsoftware.com/articles/Unicode.html">Unicode primer</a> yet, and even if I have, its such a recommended reading that I should do it again. I did a small project involving UTF-8 to Windows-1256 (Arabic) conversion on a low level a while ago, and it was most illuminating. </li>
<li>My <a href="http://www.idg.se/ArticlePages/200404/28/20040428093934_IDG.se884/20040428093934_IDG.se884.dbp.asp">column</a> on the Smalltalk heritage on IDG has spawned a small <a href="http://www.idg.se/tjanster/artikelforum/default.asp?art=20040428093934_IDG.se884">debate</a> about &#8221;industry languages&#8221; such as Java and C# compared to more dynamic, &#8221;cutting edge&#8221; languages like Smalltalk and Python. My take on the debate is that if you want to get stuff done togheter with other developers that may not be on the same level as you, C# and Java will get you there with the lowest amount of risk. For single-developer projects, or for small projects that everyone involved are really bright, Python and similarly dynamic languages (including Smalltalk, Lisp/Scheme, and even Perl) can get you there faster, while allowing you to have more fun along the way. </li>
<li>Ted Neward (By the way, it&#8217;s cool that a MVP&#8217;s RSS feed URL ends in .jsp <img src='http://blog.tomtebo.org/wp-includes/images/smilies/icon_smile.gif' alt=':-)' class='wp-smiley' /> is involved in <a href="http://www.neward.net/ted/weblog/index.jsp?date=20040427#1083085266555">a debate</a> over a set of <a href="http://www.sys-con.com/story/?storyid=44375">security guidelines</a> (subscription required) published in <a href="http://sys-con.com/java/">Java Developers Journal</a>. Ted observes that for many of threats that the guidelines seek to guard against to even be theoretically exploitable, the attacker already must have greater access than he stands to gain by exploiting the vulnerability. This observation is similar to Peter Torr&#8217;s <a href="http://weblogs.asp.net/ptorr/archive/2004/04/24/119627.aspx">that VBA and Outlook&#8217;s object model</a> does not really increase the attack surface, since, for an attacker to make use of them, he must already have <a href="http://weblogs.asp.net/ptorr/archive/2004/04/16/115029.aspx">full access to the machine</a>: <i>&#8221;The problem isn&#8217;t that you have knives or saucepans or shoes in your house; it&#8217;s that the burglar keeps getting inside!&#8221;</i> </li>
<li>Cedric Beust <a href="http://beust.com/weblog/archives/000121.html">puts his money where his mouth is</a>; disappointed by <a href="http://www.junit.org/">JUnit</a>, he writes his own testing framework, <a href="http://beust.com/testng">TestNG</a>. </li>
<li><a href="http://blogs.msdn.com/brada/">Brad Adams</a> gets DDJ to allow republising Steven Clarke&#8217;s article on <a href="http://www.gotdotnet.com/team/brada/APIUsability.pdf">Measuring API Usability</a>.</li>
</ul>
]]></content:encoded>
			<wfw:commentRss>http://blog.tomtebo.org/2004/04/29/quickies_of_the_day-3/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Quickies of the day</title>
		<link>http://blog.tomtebo.org/2004/04/27/quickies_of_the_day-2/</link>
		<comments>http://blog.tomtebo.org/2004/04/27/quickies_of_the_day-2/#comments</comments>
		<pubDate>Tue, 27 Apr 2004 14:07:00 +0000</pubDate>
		<dc:creator>staffan</dc:creator>
				<category><![CDATA[programming]]></category>
		<category><![CDATA[datorsäkerhet]]></category>
		<category><![CDATA[mjukvarutestning]]></category>

		<guid isPermaLink="false">http://newblog.tomtebo.org/programming/quickies_of_the_day.html</guid>
		<description><![CDATA[Jiri has an interesting comparison between the state of infrastructure security as opposed to application security. Michael Howard has the slides from what appear to be an excellent presentation about Secure coding issues up (by way of Sergey Simakov The &#8230; <a href="http://blog.tomtebo.org/2004/04/27/quickies_of_the_day-2/">Läs mer <span class="meta-nav">&#8594;</span></a>]]></description>
			<content:encoded><![CDATA[<ul>
<li><a href="http://jludvik.net/weblog/000274.html">Jiri</a> has an interesting comparison between the state of infrastructure security as opposed to application security. </li>
<li><a href="http://blogs.msdn.com/michael_howard">Michael Howard</a> has the slides from what appear to be an excellent presentation about <a href="http://www.route64.net/slidedecks/SecureCoding.ppt">Secure coding issues</a> up (by way of <a href="http://geekswithblogs.net/ssimakov/archive/2004/04/26/4364.aspx">Sergey Simakov</a> </li>
<li>The widely-talked-about <a href="http://www.osvdb.org/reference/SlippingInTheWindow_v1.0.doc">paper</a> from Paul Watson on the TCP reset vulnerability that threatened to <a href="http://slashdot.org/article.pl?sid=04/04/20/1738217&amp;tid=128">destroy the internet</a> last week is now online. </li>
<li>Charles Miller <a href="http://fishbowl.pastiche.org/2004/04/27/where_bugs_come_from">discusses</a> where bugs come from, and why unit testing only will catch a part of them. </li>
<li>Mr Ed from Hacknot asks all developers to <a href="http://www.hacknot.info/hacknot/action/showEntry?eid=52">spare</a> a thought for the next guy that will change your code &#8212; it could be you. </li>
</ul>
<p>Also, with all the recent book reviews all over the .Net blogosphere, I broke down and went crazy on Amazon. The following books should soon be here: </p>
<ul>
<li><a href="http://www.amazon.com/exec/obidos/tg/detail/-/020172152X/103-1159581-8156629?%5Fencoding=UTF8">Building Secure Software: How to Avoid Security Problems the Right Way</a> [Hardcover] By: John Viega (Author), Gary McGraw (Author)</li>
<li><a href="http://www.amazon.com/exec/obidos/tg/detail/-/0321154894/103-1159581-8156629?%5Fencoding=UTF8">.NET Framework Standard Library Annotated Reference, Volume 1: Base Class Library and Extended Numerics Library, 1/e</a> [Hardcover] By: Brad Abrams (Author)</li>
<li><a href="http://www.amazon.com/exec/obidos/tg/detail/-/0471223573/103-1159581-8156629?%5Fencoding=UTF8">Practical Cryptography</a> [Paperback] By: Niels Ferguson (Author), Bruce Schneier (Author)</li>
<li><a href="http://www.amazon.com/exec/obidos/tg/detail/-/0201786958/103-1159581-8156629?%5Fencoding=UTF8">Exploiting Software : How to Break Code</a> [Paperback] By: Greg Hoglund (Author), Gary McGraw (Author)</li>
<li><a href="http://www.amazon.com/exec/obidos/tg/detail/-/0735617228/103-1159581-8156629?%5Fencoding=UTF8">Writing Secure Code, Second Edition</a> [Paperback] By: Michael Howard (Author), David C. LeBlanc</li>
<li><a href="http://www.amazon.com/exec/obidos/tg/detail/-/0321154916/103-1159581-8156629?%5Fencoding=UTF8">The C# Programming Language</a> [Hardcover] By: Anders Hejlsberg (Author), et al</li>
<li><a href="http://www.amazon.com/exec/obidos/tg/detail/-/0201734117/103-1159581-8156629?%5Fencoding=UTF8">Essential .NET, Volume I: The Common Language Runtime</a> [Paperback] By: Don Box (Author)</li>
<li><a href="http://www.amazon.com/exec/obidos/tg/detail/-/0596002424/103-1159581-8156629?%5Fencoding=UTF8">Secure Coding: Principles and Practices</a> [Paperback] By: Mark G. Graff, Kenneth R. Van Wyk</li>
</ul>
]]></content:encoded>
			<wfw:commentRss>http://blog.tomtebo.org/2004/04/27/quickies_of_the_day-2/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

