Enterprise Library Test Guide - Willy .Net

Using the Test Cases 247
Specific Security Tests
Specific aspects of each application block were also tested to see if they followed
security best practices. This section discusses security issues that were found in the
Data Access Application Block and the Cryptography Application Block.
Testing the Data Access Application Block
This test case determined whether the Data Access Application Block violated security
best practices by returning the password that is stored in the ConnectionString
property to the user. It is important to ensure that this does not happen because it can
give malicious users access to sensitive information.
Test Case
The test case checked to see if the application block returned the password to the
user. If it did, the test case failed. The following code implemented the test case.
[TestMethod]
public void TestPasswordInConnectionStringWithDAAB()
{
Database db =DatabaseFactory.CreateDatabase("PasswordProtectedConnectionString
Instance");
db.Connection.Open();
string connectionString = db.ConnectionString;
db.Connection.Close();
if (connectionString.Contains("password=test"))
{
Assert.Fail();
}
}
Problem
The test case failed because the Database class exposed the ConnectionString property
as a public member. This allowed a user to read the password. The following
code caused the problem.
public string ConnectionString
{
get
{
return this.connectionString.ToString();
}
}
Solution
The Database class was modified so that the ConnectionString property was
changed from a public member to a protected internal member. A new public property
named ConnectionStringWithoutCredentials was added. This property returns