57 lines
2.0 KiB
Python
57 lines
2.0 KiB
Python
#!/usr/bin/env python3
|
|
|
|
import importlib.util
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
from unittest import mock
|
|
|
|
|
|
PROJECT_ROOT = Path(__file__).resolve().parents[1]
|
|
MODULE_PATH = PROJECT_ROOT / "tools" / "check-secrets.py"
|
|
SPEC = importlib.util.spec_from_file_location("check_secrets", MODULE_PATH)
|
|
MODULE = importlib.util.module_from_spec(SPEC)
|
|
assert SPEC.loader is not None
|
|
SPEC.loader.exec_module(MODULE)
|
|
|
|
|
|
class SnapshotScannerTests(unittest.TestCase):
|
|
def test_snapshot_without_git_scans_regular_files(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
(root / "safe.txt").write_text("safe\n", encoding="utf-8")
|
|
(root / ".venv").mkdir()
|
|
(root / ".venv" / "ignored.txt").write_text(
|
|
"JWEBOT_EDGE_STEAM_API_KEY=not-for-scan\n",
|
|
encoding="utf-8",
|
|
)
|
|
with mock.patch.object(MODULE, "ROOT", root), mock.patch.object(
|
|
MODULE,
|
|
"has_git_repository",
|
|
return_value=False,
|
|
):
|
|
self.assertEqual(MODULE.tracked_paths(), ["safe.txt"])
|
|
self.assertEqual(MODULE.scan_tracked(), [])
|
|
|
|
def test_snapshot_scanner_reports_fingerprint_not_value(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
(root / "config.env").write_text(
|
|
"JWEBOT_EDGE_STEAM_API_KEY=local-sensitive-value\n",
|
|
encoding="utf-8",
|
|
)
|
|
with mock.patch.object(MODULE, "ROOT", root), mock.patch.object(
|
|
MODULE,
|
|
"has_git_repository",
|
|
return_value=False,
|
|
):
|
|
findings = MODULE.scan_tracked()
|
|
|
|
self.assertEqual(findings[0][0], "populated_secret")
|
|
self.assertEqual(findings[0][1], "config.env")
|
|
self.assertNotIn("local-sensitive-value", str(findings))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|