8dfab4ba14
Ausfuehrbares Pruefpaket fuer Payment-Terminal-Systeme: 1. Semgrep-Regeln (25 Regeln in 5 Dateien): - Logging: Sensitive Daten, Tokens, Debug-Flags - Crypto: MD5/SHA1/DES/ECB, Hardcoded Secrets, Weak Random, TLS - API: Debug-Routes, Exception Leaks, IDOR, Input Validation - Config: Test-Endpoints, CORS, Cookies, Retry - Data: Telemetrie, Cache, Export, Queue, Testdaten 2. CodeQL Query-Specs (5 Briefings): - Sensitive Data → Logs - Sensitive Data → HTTP Response - Tenant Context Loss - Sensitive Data → Telemetry - Cache/Export Leak 3. State-Machine-Tests (10 Testfaelle): - 11 Zustaende, 15 Events, 8 Invarianten - Duplicate Response, Timeout+Late Success, Decline - Invalid Reversal, Cancel, Backend Timeout - Parallel Reversal, Unknown Response, Reconnect - Late Response after Cancel 4. Finding Schema (JSON Schema): - Einheitliches Format fuer alle Engines - control_id, engine, status, confidence, evidence, verdict_text Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
93 lines
3.2 KiB
JSON
93 lines
3.2 KiB
JSON
[
|
|
{
|
|
"test_id": "ZVT-SM-001",
|
|
"name": "Duplicate approved response",
|
|
"initial_state": "WAITING_FOR_TERMINAL",
|
|
"events": ["terminal_approve", "duplicate_response"],
|
|
"expected_final_state": "APPROVED",
|
|
"invariants": ["Invariant 3"],
|
|
"mapped_controls": ["TRANS-004", "TRANS-009", "ZVT-RESP-005"]
|
|
},
|
|
{
|
|
"test_id": "ZVT-SM-002",
|
|
"name": "Timeout then late success",
|
|
"initial_state": "WAITING_FOR_TERMINAL",
|
|
"events": ["terminal_timeout", "terminal_approve"],
|
|
"expected_final_state": "DESYNC",
|
|
"invariants": ["Invariant 4", "Invariant 7", "Invariant 8"],
|
|
"mapped_controls": ["TRANS-005", "TRANS-007", "TERMSYNC-009", "TERMSYNC-010"]
|
|
},
|
|
{
|
|
"test_id": "ZVT-SM-003",
|
|
"name": "Decline must not produce booking",
|
|
"initial_state": "WAITING_FOR_TERMINAL",
|
|
"events": ["terminal_decline"],
|
|
"expected_final_state": "DECLINED",
|
|
"invariants": ["Invariant 2"],
|
|
"mapped_controls": ["TRANS-011", "TRANS-025", "ZVT-RESP-002"]
|
|
},
|
|
{
|
|
"test_id": "ZVT-SM-004",
|
|
"name": "Invalid reversal before approval",
|
|
"initial_state": "PAYMENT_REQUESTED",
|
|
"events": ["reversal_request"],
|
|
"expected_final_state": "ERROR",
|
|
"invariants": ["Invariant 6"],
|
|
"mapped_controls": ["ZVT-REV-001", "ZVT-STATE-002", "ZVT-CMD-001"]
|
|
},
|
|
{
|
|
"test_id": "ZVT-SM-005",
|
|
"name": "Cancel during waiting",
|
|
"initial_state": "WAITING_FOR_TERMINAL",
|
|
"events": ["cancel_request"],
|
|
"expected_final_state": "CANCELLED",
|
|
"invariants": ["Invariant 7"],
|
|
"mapped_controls": ["TRANS-006", "ZVT-CMD-001", "ZVT-STATE-003"]
|
|
},
|
|
{
|
|
"test_id": "ZVT-SM-006",
|
|
"name": "Backend timeout after terminal ack",
|
|
"initial_state": "WAITING_FOR_TERMINAL",
|
|
"events": ["terminal_ack", "backend_timeout"],
|
|
"expected_final_state": "DESYNC",
|
|
"invariants": ["Invariant 4", "Invariant 7"],
|
|
"mapped_controls": ["TERMSYNC-010", "TRANS-012", "ZVT-SESSION-003"]
|
|
},
|
|
{
|
|
"test_id": "ZVT-SM-007",
|
|
"name": "Parallel reversal requests",
|
|
"initial_state": "APPROVED",
|
|
"events": ["reversal_request", "reversal_request"],
|
|
"expected_final_state": "REVERSAL_PENDING",
|
|
"invariants": ["Invariant 5"],
|
|
"mapped_controls": ["ZVT-REV-003", "TRANS-016", "TRANS-019"]
|
|
},
|
|
{
|
|
"test_id": "ZVT-SM-008",
|
|
"name": "Unknown response code",
|
|
"initial_state": "WAITING_FOR_TERMINAL",
|
|
"events": ["terminal_ack", "invalid_command"],
|
|
"expected_final_state": "ERROR",
|
|
"invariants": ["Invariant 6"],
|
|
"mapped_controls": ["ZVT-RESP-003", "ZVT-COM-005", "ZVT-STATE-005"]
|
|
},
|
|
{
|
|
"test_id": "ZVT-SM-009",
|
|
"name": "Reconnect and resume controlled",
|
|
"initial_state": "SESSION_OPEN",
|
|
"events": ["send_payment", "terminal_timeout", "reconnect"],
|
|
"expected_final_state": "WAITING_FOR_TERMINAL",
|
|
"invariants": ["Invariant 7"],
|
|
"mapped_controls": ["ZVT-SESSION-004", "TRANS-007", "ZVT-RT-004"]
|
|
},
|
|
{
|
|
"test_id": "ZVT-SM-010",
|
|
"name": "Late response after cancel",
|
|
"initial_state": "WAITING_FOR_TERMINAL",
|
|
"events": ["cancel_request", "terminal_approve"],
|
|
"expected_final_state": "DESYNC",
|
|
"invariants": ["Invariant 4", "Invariant 8"],
|
|
"mapped_controls": ["TERMSYNC-008", "TERMSYNC-009", "TRANS-018"]
|
|
}
|
|
]
|