|
| 1 | +"""Tests for credential redaction in log output. |
| 2 | +
|
| 3 | +The CLI runs in customer CI. Its stdout lands in job logs that are retained, |
| 4 | +shared in support tickets and public for public repositories, and the log |
| 5 | +streamer uploads records to Socket with no level filter. Credentials must not |
| 6 | +reach any of that. |
| 7 | +""" |
| 8 | + |
| 9 | +import dataclasses |
| 10 | +import logging |
| 11 | + |
| 12 | +import pytest |
| 13 | + |
| 14 | +from socketsecurity.config import CliConfig |
| 15 | +from socketsecurity.redaction import REDACTED, is_sensitive_name, redact_mapping, redact_url |
| 16 | + |
| 17 | +TOKEN = "sk-not-a-real-token-abc123" |
| 18 | +# CliConfig.from_args reads these before falling back to --api-token, and |
| 19 | +# socketcli calls load_dotenv() on import, so a developer's .env leaks in as |
| 20 | +# soon as another test module imports it. Clear them so these tests are |
| 21 | +# hermetic regardless of collection order. |
| 22 | +_TOKEN_ENV_VARS = ( |
| 23 | + "SOCKET_SECURITY_API_KEY", |
| 24 | + "SOCKET_SECURITY_API_TOKEN", |
| 25 | + "SOCKET_API_KEY", |
| 26 | + "SOCKET_API_TOKEN", |
| 27 | +) |
| 28 | + |
| 29 | + |
| 30 | +@pytest.fixture(autouse=True) |
| 31 | +def _clear_token_env(monkeypatch): |
| 32 | + for name in _TOKEN_ENV_VARS: |
| 33 | + monkeypatch.delenv(name, raising=False) |
| 34 | + |
| 35 | + |
| 36 | +WEBHOOK = "https://hooks.slack.com/services/T00000/B00000/XXXXXXXXsecretXXXXXXXX" |
| 37 | + |
| 38 | + |
| 39 | +@pytest.mark.parametrize( |
| 40 | + "name", |
| 41 | + ["api_token", "API_TOKEN", "github_token", "slack_webhook", "client_secret", "password", "auth_header", "api_key"], |
| 42 | +) |
| 43 | +def test_credential_field_names_are_recognised(name): |
| 44 | + assert is_sensitive_name(name) |
| 45 | + |
| 46 | + |
| 47 | +@pytest.mark.parametrize("name", ["repo", "branch", "commit_sha", "target_path", "scm", "enable_debug"]) |
| 48 | +def test_ordinary_field_names_are_not_recognised(name): |
| 49 | + assert not is_sensitive_name(name) |
| 50 | + |
| 51 | + |
| 52 | +def test_webhook_url_keeps_the_host_and_drops_the_secret_path(): |
| 53 | + redacted = redact_url(WEBHOOK) |
| 54 | + assert redacted == "https://hooks.slack.com/***redacted***" |
| 55 | + assert "secret" not in redacted |
| 56 | + |
| 57 | + |
| 58 | +def test_redact_url_strips_userinfo(): |
| 59 | + assert redact_url("https://user:hunter2@example.com:8443/path?q=1") == "https://example.com:8443/***redacted***" |
| 60 | + assert "hunter2" not in redact_url("https://user:hunter2@example.com/x") |
| 61 | + |
| 62 | + |
| 63 | +@pytest.mark.parametrize("value", ["Not configured", "", None, "not-a-url"]) |
| 64 | +def test_non_urls_pass_through_so_placeholders_stay_readable(value): |
| 65 | + assert redact_url(value) == value |
| 66 | + |
| 67 | + |
| 68 | +def test_redact_mapping_masks_secrets_and_keeps_everything_else(): |
| 69 | + out = redact_mapping({"api_token": TOKEN, "slack_webhook": WEBHOOK, "repo": "acme/widgets", "enable_debug": True}) |
| 70 | + assert out["api_token"] == REDACTED |
| 71 | + assert out["slack_webhook"] == "https://hooks.slack.com/***redacted***" |
| 72 | + assert out["repo"] == "acme/widgets" |
| 73 | + assert out["enable_debug"] is True |
| 74 | + |
| 75 | + |
| 76 | +@pytest.mark.parametrize("empty", ["", None]) |
| 77 | +def test_unset_secrets_are_left_alone(empty): |
| 78 | + """ "No token configured" is useful debugging information, not a secret.""" |
| 79 | + assert redact_mapping({"api_token": empty})["api_token"] == empty |
| 80 | + |
| 81 | + |
| 82 | +def test_config_to_dict_is_still_a_faithful_serialiser(): |
| 83 | + config = CliConfig.from_args(["--api-token", TOKEN, "--repo", "acme/widgets"]) |
| 84 | + assert config.to_dict()["api_token"] == TOKEN |
| 85 | + |
| 86 | + |
| 87 | +def test_config_to_redacted_dict_masks_the_api_token(): |
| 88 | + config = CliConfig.from_args(["--api-token", TOKEN, "--repo", "acme/widgets"]) |
| 89 | + assert config.to_redacted_dict()["api_token"] == REDACTED |
| 90 | + assert TOKEN not in str(config.to_redacted_dict()) |
| 91 | + |
| 92 | + |
| 93 | +def test_every_credential_field_on_cliconfig_is_redacted(): |
| 94 | + """Guard against a future secret field being added and quietly logged. |
| 95 | +
|
| 96 | + Sets every credential-named field to a sentinel and asserts none of them |
| 97 | + survive into the redacted view, so `github_token` or similar is covered |
| 98 | + without anyone editing this test. |
| 99 | + """ |
| 100 | + config = CliConfig.from_args(["--api-token", TOKEN, "--repo", "acme/widgets"]) |
| 101 | + sentinels = {} |
| 102 | + for field in dataclasses.fields(CliConfig): |
| 103 | + if is_sensitive_name(field.name): |
| 104 | + sentinel = f"SENTINEL-{field.name}-value" |
| 105 | + setattr(config, field.name, sentinel) |
| 106 | + sentinels[field.name] = sentinel |
| 107 | + |
| 108 | + assert sentinels, "expected CliConfig to declare at least one credential field" |
| 109 | + rendered = str(config.to_redacted_dict()) |
| 110 | + for name, sentinel in sentinels.items(): |
| 111 | + assert sentinel not in rendered, f"{name} leaked into the redacted config" |
| 112 | + |
| 113 | + |
| 114 | +def test_the_config_debug_line_does_not_emit_the_token(caplog): |
| 115 | + """End-to-end guard on the line CodeQL's sibling alert pointed at.""" |
| 116 | + config = CliConfig.from_args(["--api-token", TOKEN, "--repo", "acme/widgets"]) |
| 117 | + log = logging.getLogger("socketcli") |
| 118 | + with caplog.at_level(logging.DEBUG, logger="socketcli"): |
| 119 | + log.debug(f"config: {config.to_redacted_dict()}") |
| 120 | + assert TOKEN not in caplog.text |
| 121 | + assert REDACTED in caplog.text |
0 commit comments