53 lines
1.9 KiB
Python
53 lines
1.9 KiB
Python
"""Secret-shaped strings never reach the judge or the ledger. Test tokens are assembled at runtime
|
|
so this file does not itself look like it contains credentials."""
|
|
|
|
from ai_incidents.redact import MASK, Redactor
|
|
|
|
r = Redactor()
|
|
|
|
|
|
def test_token_formats():
|
|
samples = [
|
|
"gh" + "p_" + "A" * 36,
|
|
"github" + "_pat_" + "B" * 30,
|
|
"s" + "k-ant-" + "c" * 40,
|
|
"AK" + "IA" + "ABCDEFGHIJKLMNOP",
|
|
"xo" + "xb-" + "1234567890-abcdef",
|
|
"ey" + "J" + "a" * 20 + "." + "b" * 20 + "." + "c" * 20,
|
|
]
|
|
for s in samples:
|
|
out = r(f"token is {s} here")
|
|
assert s not in out and MASK in out, s
|
|
|
|
|
|
def test_private_key_block():
|
|
pem = "-----BEGIN " + "OPENSSH PRIVATE KEY-----\nabc\ndef\n-----END OPENSSH PRIVATE KEY-----"
|
|
assert r("key:\n" + pem + "\ndone") == "key:\n" + MASK + "\ndone"
|
|
|
|
|
|
def test_assignments_keep_the_key_and_drop_the_value():
|
|
assert r("db_password=s3cr3t-value") == f"db_password={MASK}"
|
|
assert r('"api_key": "abcdef123456"') == f'"api_key": "{MASK}' + '"'
|
|
assert r("SMTP_PASS" + "WORD: hunter2hunter2") == f"SMTP_PASSWORD: {MASK}"
|
|
|
|
|
|
def test_placeholders_and_numbers_are_left_alone():
|
|
for s in ["password=$DB_PASSWORD", "token: ${TOKEN}", "input_tokens: 123456", "password=********",
|
|
"secret: true"]:
|
|
assert r(s) == s, s
|
|
|
|
|
|
def test_bearer_and_url_credentials():
|
|
assert r("Authorization: Bearer " + "x" * 30) == f"Authorization: Bearer {MASK}"
|
|
assert r("postgres://app:" + "pw123456" + "@db.example.com/x") == f"postgres://app:{MASK}@db.example.com/x"
|
|
|
|
|
|
def test_ordinary_prose_untouched():
|
|
s = "The author reverted the password-reset flow; tokens were fine. See docs at https://example.com/a:b"
|
|
assert r(s) == s
|
|
|
|
|
|
def test_disabled_and_extra_patterns():
|
|
assert Redactor(enabled=False)("password=abcdefgh") == "password=abcdefgh"
|
|
assert Redactor([r"INTERNAL-\d{6}"])("id INTERNAL-123456") == f"id {MASK}"
|