Best Practices for JUnit Testing

How to Build a Unified Workflow for Security & Functional Tests in JUnit

The best way to build better Java software is to equip developers with tools that enable them to test their code themselves as a solidified part of the development process. With functional testing, this is already common practice within JUnit. Since JUnit provides an amazing playground for test automation, we (Code Intelligence) built an integration that enables security testing within JUnit using @FuzzTest.

Having unit testing and fuzz testing in a unified, developer-friendly workflow enables dev teams to close blind spots before merging. In such a setup, unit tests cover deterministic test cases of known use cases or test scenarios, while fuzz tests cover non-deterministic outcomes by automatically generating dynamic test cases to trigger interesting or unusual program states. Although most of the issues found with fuzz testing are security-related, fuzz testing can also help to find hidden functional bugs.

All of this will become very clear if we look into actual code.

Adding Unit and Fuzz Tests to JUnit

So let’s say you have a method that inserts data into a database. How would you write a test for this? 

Let’s start with this:

public class InformationDatabaseTest {

    private InformationDatabase db;

    @Test
    public void insertDataUnitTest(){ 

    }
}

One approach to write a good test is to use the “arrange, act, assert” pattern:

public class InformationDatabaseTest {

    private InformationDatabase db;

    @Test
    public void insertDataUnitTest(){ 
        // arrange our objects and test fixtures
        // act on an object to perform a test
        // assert the result of the action is as expected
    }
}

If we add some code to do these steps, it looks like this

public class InformationDatabaseTest {

    private InformationDatabase db;

    private InformationDatabase initializeDatabase(){
        InformationDatabase db = new InformationDatabase();
        db.connect();
        return db;
    }

    @Test
    public void insertDataUnitTest(){ 
        // arrange our objects and test fixtures
        db = initializeDatabase(); // initialize db object to test
        Road road = new Road("Germany"); // create a valid Road object to insert into db
        // act on an object to perform a test
        Boolean result = db.insertRoadData(road);

        // assert the result of the action is as expected
        Assert.assertTrue(result);
    }
}

This test runs and passes. We now have a unit test to verify that this method works!
But notice that we’re hard-coding a value for our test:

@Test
public void insertDataUnitTest(){ 
    // arrange our objects and test fixtures
    db = initializeDatabase(); // initialize db object to test
    Road road = new Road("Germany");  // create a valid Road object to insert into db
    // act on an object to perform a test
    Boolean result = db.insertRoadData(road);

    // assert the result of the action is as expected
    Assert.assertTrue(result);
}

This only validates the method for this single value. What about other values? Also, what about values that could cause problems but we didn’t think of? Or values we aren’t sure how to generate? There has to be a better way.

So let's add a fuzz test to our unit test to intelligently generate input values. First, we need to copy and paste our unit test into a new test and put in some fuzzy input:

public class InformationDatabaseTest {

    private InformationDatabase db;

    private InformationDatabase initializeDatabase(){
        InformationDatabase db = new InformationDatabase();
        db.connect();
        return db;
    }

    @Test
    public void insertDataUnitTest(){ 
        // arrange our objects and test fixtures
        db = initializeDatabase(); // initialize db object to test
        Road road = new Road("Germany");
// act on an object to perform a test
        Boolean result = db.insertRoadData(road);
        // assert the result of the action is as expected
        Assert.assertTrue(result);
    }

    public void insertDataFuzzTest(){
        // arrange our objects and test fixtures
        db = initializeDatabase(); // initialize db object to test
        Road road = new Road("*78?90?**c4C"); // create a valid Road object to insert into db
        // act on an object to perform a test
        Boolean result = db.insertRoadData(road);
        // assert the result of the action is as expected
        Assert.assertTrue(result);
    }
}

The fuzz test looks like it might work the same way as our unit test does. Great! Let’s get some intelligence in there, by adding objects that will generate smart data for us:

public class InformationDatabaseTest {

    private InformationDatabase db;

    private InformationDatabase initializeDatabase(){
        InformationDatabase db = new InformationDatabase();
        db.connect();
        return db;
    }

    @Test
    public void insertDataUnitTest(){ 
        // arrange our objects and test fixtures
        db = initializeDatabase(); // initialize db object to test
        Road road = new Road("Germany"); // create a valid Road object to insert into db
        // act on an object to perform a test
        Boolean result = db.insertRoadData(road);
        // assert the result of the action is as expected
        Assert.assertTrue(result);
    }

    @FuzzTest
    public void insertDataFuzzTest(FuzzedDataProvider fuzzedData){
        // arrange our objects and test fixtures
        db = initializeDatabase(); // initialize db object to test
        Road road = new Road(fuzzedData.consumeString(10)); // generate fuzzy inputs
        // act on an object to perform a test
        Boolean result = db.insertRoadData(road);
        // assert the result of the action is as expected
        Assert.assertTrue(result);
    }
}

Next, we add some additional properties to tell JUnit that this is a fuzz test:

@FuzzTest
public void insertDataFuzzTest(FuzzedDataProvider fuzzedData){
        // arrange our objects and test fixtures
        db = initializeDatabase(); // initialize db object to test
        Road road = new Road(fuzzedData.consumeString(10)); // generate fuzzy inputs
        // act on an object to perform a test
        Boolean result = db.insertRoadData(road);
        // assert the result of the action is as expected
        Assert.assertTrue(result);
}

We need a fuzzedData object to retrieve the generated data for our test, and in this case, we need a string value. This is where the magic happens!
And we’ve now created a fuzz test from a unit test, and the two can be run as needed.

Now that we’ve seen how to write a unit test and fuzz test using JUnit, let’s see what these tests produce when they’re created. 

Running The Tests

Running a unit test should be fast and easy, regardless of the programming language or testing tool used. This is the case with JUnit, which is integrated with all major Integrated Development Environments (IDEs) such as IntelliJ, Eclipse or Visual Studio Code. Tests can be run with either the click of a button or using a build tool such as Maven.

Since unit tests are functional tests, the result of a unit test is typically a passed or failed status. Running the above @UnitTest produces the following output:

The test passes and produces a green checkmark as a result.

cifuzz run InformationDatabaseTest

The result looks like this:

Here we can see information about the test run: how long the test took to run, how many findings cifuzz found and the name of specific findings that were found. In this case, cifuzz found one SQL Injection Issue and called it poetic_amoeba.

Try It Yourself

Feel free to replicate our findings yourself using RoadSmart, the GitHub sample project which the code above was taken from. You can copy all of the code snippets on this page. If you want to learn more about CI Fuzz, check out this page or book a demo.