58 lines
2.3 KiB
Python
58 lines
2.3 KiB
Python
from __future__ import annotations
|
|
|
|
import unittest
|
|
|
|
from .redaction import RedactionError, assert_no_leaks, redact, scan_for_leaks
|
|
|
|
|
|
class RedactionTests(unittest.TestCase):
|
|
def test_recursive_canary_redaction_across_all_evidence_surfaces(self) -> None:
|
|
canary = "canary-value-93f1"
|
|
evidence = {
|
|
canary + "-key": "key canary",
|
|
"environment": {"OPENAI_API_KEY": canary, "SAFE_MODE": "on"},
|
|
"argv": ["--token", canary],
|
|
"stdout": "output " + canary,
|
|
"stderr": "error " + canary,
|
|
"exception": RuntimeError("failed with " + canary),
|
|
"nested": [{"GITHUB_TOKEN": "another-value"}],
|
|
}
|
|
self.assertTrue(scan_for_leaks(evidence, canaries=[canary]))
|
|
redacted = redact(evidence, canaries=[canary])
|
|
assert_no_leaks(redacted, canaries=[canary])
|
|
self.assertEqual(redacted["environment"]["SAFE_MODE"], "on")
|
|
self.assertNotIn(canary, str(redacted))
|
|
self.assertIn("[REDACTED]", str(redacted))
|
|
|
|
def test_configured_name_pattern_is_precise_for_safe_fields(self) -> None:
|
|
evidence = {
|
|
"status": "passed",
|
|
"provider": "fixture",
|
|
"tokenCount": 2,
|
|
"MY_SECRET_ALPHA": "fixture-secret",
|
|
"message": "MY_SECRET_ALPHA was used",
|
|
}
|
|
patterns = [r"(?<![A-Za-z0-9])MY_SECRET_[A-Z]+(?![A-Za-z0-9])"]
|
|
leaks = scan_for_leaks(evidence, credential_name_patterns=patterns)
|
|
self.assertIn("MY_SECRET_ALPHA", leaks)
|
|
self.assertIn("message", leaks)
|
|
self.assertNotIn("status", leaks)
|
|
self.assertNotIn("provider", leaks)
|
|
self.assertNotIn("tokenCount", leaks)
|
|
cleaned = redact(evidence, credential_name_patterns=patterns)
|
|
assert_no_leaks(cleaned, credential_name_patterns=patterns)
|
|
self.assertEqual(cleaned["status"], "passed")
|
|
self.assertEqual(cleaned["provider"], "fixture")
|
|
self.assertEqual(cleaned["tokenCount"], 2)
|
|
|
|
def test_leak_assertion_rejects_unredacted_summary_material(self) -> None:
|
|
with self.assertRaises(RedactionError):
|
|
assert_no_leaks(
|
|
{"observation": "GITHUB_TOKEN still visible"},
|
|
canaries=["a-secret-canary"],
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|