HAL9000
48dd67eb84
CI / benchmark-publish (pull_request) Has been skipped
CI / push-validation (pull_request) Successful in 23s
CI / helm (pull_request) Successful in 31s
CI / build (pull_request) Successful in 1m5s
CI / lint (pull_request) Successful in 1m27s
CI / quality (pull_request) Successful in 1m29s
CI / typecheck (pull_request) Successful in 1m32s
CI / security (pull_request) Successful in 1m32s
CI / e2e_tests (pull_request) Successful in 4m56s
CI / integration_tests (pull_request) Successful in 6m29s
CI / unit_tests (pull_request) Successful in 8m32s
CI / docker (pull_request) Successful in 1m33s
CI / coverage (pull_request) Successful in 11m7s
CI / status-check (pull_request) Successful in 4s
CI / helm (push) Successful in 28s
CI / build (push) Successful in 53s
CI / lint (push) Successful in 1m10s
CI / quality (push) Successful in 1m10s
CI / typecheck (push) Successful in 1m19s
CI / security (push) Successful in 1m35s
CI / benchmark-regression (push) Has been skipped
CI / benchmark-publish (push) Has started running
CI / push-validation (push) Successful in 22s
CI / integration_tests (push) Successful in 4m28s
CI / e2e_tests (push) Successful in 5m13s
CI / unit_tests (push) Successful in 5m44s
CI / docker (push) Successful in 1m27s
CI / coverage (push) Successful in 13m15s
CI / status-check (push) Successful in 3s
CI / benchmark-regression (pull_request) Successful in 1h2m50s
Rebase onto latest master to resolve CHANGELOG.md merge conflict.
All test files unchanged from the approved PR commit (6c411be1).
CHANGELOG entry added to the ### Added section under ## [Unreleased].
ISSUES CLOSED: #1095
28 lines
1.5 KiB
Gherkin
28 lines
1.5 KiB
Gherkin
# This test captures bug #991 — AuditService._ensure_session() TOCTOU race.
|
|
#
|
|
# The @tdd_expected_fail tag inverts the test result: the underlying assertion
|
|
# fails (proving the bug exists) but CI reports the scenario as passed.
|
|
# When #991 is fixed, the @tdd_expected_fail tag must be removed.
|
|
#
|
|
# See: https://git.cleverthis.com/cleveragents/cleveragents-core/issues/991
|
|
|
|
@tdd_expected_fail @tdd_bug @tdd_bug_991 @tdd_issue @tdd_issue_991
|
|
Feature: TDD Bug #991 — AuditService._ensure_session() TOCTOU race
|
|
AuditService._ensure_session() checks ``if self._session is None``, then
|
|
creates an engine, runs create_all, builds a sessionmaker, and assigns
|
|
self._session — all without a threading.Lock. If two threads call
|
|
_ensure_session() concurrently, both see self._session is None, both
|
|
create separate engines and sessions, and the second assignment wins,
|
|
leaking the first engine/session.
|
|
|
|
This test proves the race exists by launching multiple threads that call
|
|
_ensure_session() simultaneously via a threading.Barrier and verifying
|
|
that create_engine is called exactly once (the correct, thread-safe
|
|
behavior). Without the fix, create_engine is called multiple times.
|
|
|
|
Scenario: Concurrent _ensure_session() calls must create only one engine
|
|
Given an AuditService with no pre-injected session and a temp database
|
|
When 10 threads call _ensure_session concurrently through a barrier
|
|
Then create_engine should have been called exactly once
|
|
And all 10 threads should have completed with a session or error
|