Near-100% test coverage did not catch a CVE in my Go library(blog.reqproof.com)
blog.reqproof.com
Near-100% test coverage did not catch a CVE in my Go library
https://blog.reqproof.com/p/i-had-near-100-test-coverage-it-didnt
1 comments
for parsers, malformed input probably has to be part of the actual spec, not just an edge case. A small set of bad-input tests plus fuzzing seems more useful than chasing the last few percent of line coverage