34 lines
1.2 KiB
Python
34 lines
1.2 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
import logging
|
|
|
|
from app.logging_config import JsonFormatter, redact
|
|
|
|
|
|
def test_json_formatter_whitelists_fields_and_redacts_secrets() -> None:
|
|
record = logging.LogRecord(
|
|
name="rf4.test", level=logging.INFO, pathname=__file__, lineno=1,
|
|
msg="authorization=Bearer-secret token=top-secret Bearer abc.def",
|
|
args=(), exc_info=None,
|
|
)
|
|
record.request_id = "safe-request-id"
|
|
record.method = "GET"
|
|
record.path = "/api/v1/activity"
|
|
record.player_name = "Must Not Leak"
|
|
payload = json.loads(JsonFormatter().format(record))
|
|
assert payload["request_id"] == "safe-request-id"
|
|
assert payload["method"] == "GET"
|
|
assert payload["path"] == "/api/v1/activity"
|
|
assert "player_name" not in payload
|
|
assert "top-secret" not in payload["message"]
|
|
assert "abc.def" not in payload["message"]
|
|
assert payload["message"].count("[REDACTED]") == 3
|
|
|
|
|
|
def test_redact_covers_common_credential_forms() -> None:
|
|
cleaned = redact("password=hunter2 secret: swordfish Authorization: token-value")
|
|
assert "hunter2" not in cleaned
|
|
assert "swordfish" not in cleaned
|
|
assert "token-value" not in cleaned
|