tests: Added test to fix masking for pem and jwk keys. - #2139
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2139 +/- ##
=======================================
Coverage 35.92% 35.92%
=======================================
Files 82 82
Lines 7832 7832
=======================================
Hits 2814 2814
Misses 4753 4753
Partials 265 265 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
shivaygupta-dotcom
added
skip-konnect
6470ba0 to
dfc63a7
Compare
78b1b49 to
00a1d45
Compare
247b6eb to
1b5d19d
Compare
| require.Contains(t, output, `"Authorization:Bearer [masked]"`, "bearer token should be masked") | ||
| require.Contains(t, output, `"X-Webhook-Secret:[masked]"`, "webhook secret should be masked") | ||
|
|
||
| // Verify the current secret values are NOT exposed in the output |
There was a problem hiding this comment.
What about the older secrets, like apiKeySecret? Can we check for absence of those too below? Those shouldn't leak either.
There was a problem hiding this comment.
If I understand your comment correctly, you’re referring to verifying the secret that was set during the first sync, for example:
t.Setenv("DECK_API_KEY", "apiKeySecret")
This is actually a known issue. When we run sync again after changing the environment variable value, the previous secret can be exposed in the output. We’re already addressing this as part of a separate issue. #2140
Please let me know if I misunderstood your comment or if you were referring to something else.
There was a problem hiding this comment.
Cool. Everything else looks fine to me. Will approve once the CI is green.
There was a problem hiding this comment.
done. you can approve now.
3 participants
Added test for env var masking fix for PEM and JWK keys.
GH: #2132
gdrPR: Kong/go-database-reconciler#494