opensource/mateclaw
2
0
Fork 0
mirror of https://gitee.com/mateos/mateclaw.git synced 2026-09-13 19:23:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

test(skill): use placeholder bodies in credential-redaction fixtures

Browse Source
This commit is contained in:
matevip 2026-08-06 01:55:48 -04:00
parent e22173a476
commit 48a7b979df
1 changed files with 14 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
mateclaw-server/src/test/java/vip/mate/common/text/SecretRedactorTest.java
View File

@ -23,8 +23,8 @@ class SecretRedactorTest {
@Test @Test
@DisplayName("OpenAI-style keys are masked, including project keys") @DisplayName("OpenAI-style keys are masked, including project keys")
void masksOpenAiKeys() { void masksOpenAiKeys() {
String out = SecretRedactor.redact("use sk-proj-abcdef1234567890abcdef1234567890 now"); String out = SecretRedactor.redact("use sk-proj-PLACEHOLDEREXAMPLEVALUE now");
assertFalse(out.contains("abcdef1234567890"), out); assertFalse(out.contains("PLACEHOLDEREXAMPLEVALUE"), out);
assertTrue(out.contains(SecretRedactor.MASK), out); assertTrue(out.contains(SecretRedactor.MASK), out);
assertTrue(out.startsWith("use ") && out.endsWith(" now"), out); assertTrue(out.startsWith("use ") && out.endsWith(" now"), out);
} }
@ -32,19 +32,25 @@ class SecretRedactorTest {
@Test @Test
@DisplayName("an assignment keeps the field name and masks only the value") @DisplayName("an assignment keeps the field name and masks only the value")
void masksAssignmentValueOnly() { void masksAssignmentValueOnly() {
String out = SecretRedactor.redact("api_key = \"sk-proj-abcdef1234567890abcdef\""); String out = SecretRedactor.redact("api_key = \"sk-proj-PLACEHOLDEREXAMPLEVALUE\"");
assertTrue(out.contains("api_key"), "the field name is what makes the text readable: " + out); assertTrue(out.contains("api_key"), "the field name is what makes the text readable: " + out);
assertFalse(out.contains("abcdef"), out); assertFalse(out.contains("PLACEHOLDER"), out);
} }
@Test @Test
@DisplayName("bearer headers, GitHub, Slack, Google and AWS keys are masked") @DisplayName("bearer headers, GitHub, Slack, Google and AWS keys are masked")
void masksCommonProviderShapes() { void masksCommonProviderShapes() {
// Fixture bodies spell out PLACEHOLDER rather than mimicking real key
// material. They still exercise every pattern, but a repository secret
// scanner reads a test fixture and a leaked credential the same way —
// a realistic-looking fixture blocks the push and teaches contributors
// to allowlist scanner hits, which is the habit that lets a real one
// through.
for (String secret : new String[]{ for (String secret : new String[]{
"Bearer eyJhbGciOiJIUzI1NiJ9.abcdefghijklmnop", "Bearer PLACEHOLDER.PLACEHOLDER.EXAMPLEVALUE",
"ghp_abcdefghijklmnopqrstuvwxyz012345", "ghp_PLACEHOLDEREXAMPLEVALUENOTAREALKEY",
"xoxb-123456789012-abcdefghijklmno", "xoxb-PLACEHOLDER-EXAMPLE-VALUE-NOT-A-REAL-KEY",
"AIzaSyABCDEFGHIJKLMNOPQRSTUVWXYZ01234", "AIzaPLACEHOLDEREXAMPLEVALUENOTAREALKEY",
"AKIAIOSFODNN7EXAMPLE", "AKIAIOSFODNN7EXAMPLE",
}) { }) {
String out = SecretRedactor.redact("prefix " + secret + " suffix"); String out = SecretRedactor.redact("prefix " + secret + " suffix");