test_no_secret_leak.py
file-level
1
files
1
commits
0
hotspots
0
🧊 dead
0
💥 blast risk
| 1 | """Security tests — no secrets or absolute paths in output.""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | import re |
| 6 | from io import StringIO |
| 7 | from pathlib import Path |
| 8 | from unittest.mock import patch |
| 9 | |
| 10 | from cli.context import CliContext |
| 11 | from cli.main import main |
| 12 | from cli.output import OutputContext |
| 13 | from tests.support import git_status_runner |
| 14 | |
| 15 | |
| 16 | ABS_PATH_RE = re.compile(r"/(?:Users|home|tmp|var)/") |
| 17 | |
| 18 | |
| 19 | def test_no_absolute_paths_in_status_json(tmp_path: Path) -> None: |
| 20 | from tests.support import run_cli |
| 21 | |
| 22 | run_cli(["init", "--regime", "git-only", "--non-interactive"], cwd=tmp_path) |
| 23 | out = StringIO() |
| 24 | with patch("sys.stdout", out): |
| 25 | main( |
| 26 | ["status", "--json"], |
| 27 | ctx=CliContext.create( |
| 28 | cwd=tmp_path, |
| 29 | runner=git_status_runner(), |
| 30 | output=OutputContext(json_mode=True), |
| 31 | ), |
| 32 | ) |
| 33 | text = out.getvalue() |
| 34 | assert not ABS_PATH_RE.search(text) |
| 35 | assert "token" not in text.lower() |