44 lines
1.2 KiB
Go
44 lines
1.2 KiB
Go
package audit
|
|
|
|
import (
|
|
"bytes"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestLoggerRedactsSecrets(t *testing.T) {
|
|
path := filepath.Join(t.TempDir(), "agent.log")
|
|
var console bytes.Buffer
|
|
l, err := New(&console, path, false)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
l.AddSecret("sk-supersecretvalue123", "sk-sup...123")
|
|
l.Infof("connecting with key sk-supersecretvalue123")
|
|
l.Warnf("warn sk-supersecretvalue123")
|
|
l.Action("task", "cli", "command", "curl -H 'Bearer sk-supersecretvalue123'")
|
|
l.Debugf("hidden debug")
|
|
l.Close()
|
|
|
|
data, _ := os.ReadFile(path)
|
|
all := string(data) + console.String()
|
|
if strings.Contains(all, "sk-supersecretvalue123") {
|
|
t.Fatalf("secret leaked:\n%s", all)
|
|
}
|
|
if !strings.Contains(string(data), "sk-sup...123") || !strings.Contains(string(data), "ACTION task=\"cli\"") {
|
|
t.Errorf("log content:\n%s", data)
|
|
}
|
|
if strings.Contains(all, "hidden debug") {
|
|
t.Error("DEBUG must be hidden without --verbose")
|
|
}
|
|
if strings.Contains(console.String(), "connecting") {
|
|
t.Error("INFO must not reach console without --verbose")
|
|
}
|
|
st, _ := os.Stat(path)
|
|
if st.Mode().Perm() != 0o600 {
|
|
t.Errorf("perm = %o", st.Mode().Perm())
|
|
}
|
|
}
|