mirror of
https://github.com/ChuckBuilds/LEDMatrix.git
synced 2026-08-22 02:48:15 +00:00
ChuckBuildsandClaude Opus 5
d64fa9761a
Three review findings from #485 that I missed when addressing that PR; it has since merged, so they land here. 1. Array-item secrets destroyed by any unrelated save (data loss). remove_empty_secrets recursed into dicts but let a list fall through to the scalar branch and kept it verbatim. Lists merge by *replacement*, so the blanks the masked form posts back went straight over the stored array: stored [{"name":"a","token":"REAL-A"}, {"name":"b","token":"REAL-B"}] posted [{"name":"a","token":""}, {"name":"b","token":""}] merged [{"name":"a","token":""}, {"name":"b","token":""}] -> both credentials gone Same failure as the scalar api_key case fixed earlier, one container deeper. Lists now prune element-wise, and a list with nothing real in it is dropped so the stored one is left alone. Where one entry does change, the new merge_secrets merges by index instead of replacing. Two details the first attempt got wrong, both caught by existing tests: - An emptied dict item must stay {}, not None. ConfigManager's _strip_secrets_recursive treats a secrets list as *parallel* to the regular one ({} = "item i has no secrets"); a None makes it stop looking parallel, and it then drops the whole key from the main config -- silently deleting the items' non-secret fields too. - The incoming list's length wins. The regular config's list is authoritative about how many items exist, so preserving surplus stored entries would let the two fall out of step and make deleting an entry impossible. 2. Submitted credentials written to the journal (security). save_plugin_config logged `Full config: {plugin_config}` at INFO and `Config that failed: {plugin_config}` at ERROR. Both run before separate_secrets, so plugin_config still held the values just typed into the form. Now keys only. Swept the rest of web_interface/ and src/ for the same shape -- these were the only two. 3. Restart banner kept stale wording. showRestartPending() cleared the stored custom text but left the DOM element alone, so a config save could show the previous update's message. The default is read back from the server-rendered copy rather than duplicated in JS, so the template stays the one owner of the string. Verified: 556 passed, 1 skipped across the web suite. Mutation-checked -- reverting api_v3 fails the logging guard and the array-merge test; reverting either half of the secret_helpers change fails the unit tests. New end-to-end coverage drives the real endpoint, not just the helpers. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01STMbQE4YctTacQXfbYqKuW
46 lines
2.0 KiB
Python
46 lines
2.0 KiB
Python
"""The validation logging ran before separate_secrets, so it logged credentials.
|
|
|
|
api_v3's plugin-config save logged `Full config: {plugin_config}` at INFO and
|
|
`Config that failed: {plugin_config}` at ERROR. Both run *before*
|
|
separate_secrets(), so plugin_config still held the values the user just typed
|
|
into the form -- API keys and tokens went to the journal in clear text.
|
|
"""
|
|
import re
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
SOURCE = (Path(__file__).resolve().parents[2]
|
|
/ "web_interface" / "blueprints" / "api_v3.py")
|
|
|
|
#: Objects that still hold submitted secret values at the point these log
|
|
#: calls run. Interpolating one whole into a log message leaks credentials.
|
|
UNREDACTED = ("plugin_config", "secrets_config", "current_secrets")
|
|
|
|
|
|
def _logging_lines():
|
|
for number, line in enumerate(SOURCE.read_text(encoding="utf-8").splitlines(), 1):
|
|
stripped = line.strip()
|
|
if stripped.startswith("#"):
|
|
continue
|
|
if re.match(r"logger\.(debug|info|warning|error|critical|exception)\(", stripped):
|
|
yield number, stripped
|
|
|
|
|
|
@pytest.mark.parametrize("name", UNREDACTED)
|
|
def test_no_log_call_interpolates_a_whole_secret_bearing_object(name):
|
|
# {name} or {name['k']} leaks; {list(name.keys())} and {len(name)} do not.
|
|
bare = re.compile(r"\{" + re.escape(name) + r"(\[[^\]]*\])*\}")
|
|
offenders = [f"{n}: {text}" for n, text in _logging_lines() if bare.search(text)]
|
|
assert not offenders, (
|
|
f"{name} still holds submitted secrets where these log calls run:\n "
|
|
+ "\n ".join(offenders))
|
|
|
|
|
|
def test_the_guard_would_notice_a_reintroduced_leak():
|
|
"""Pin the detector itself, so a rewrite cannot silently stop matching."""
|
|
bare = re.compile(r"\{" + re.escape("plugin_config") + r"(\[[^\]]*\])*\}")
|
|
assert bare.search('logger.info(f"Full config: {plugin_config}")')
|
|
assert bare.search("logger.error(f\"{plugin_config['api_key']}\")")
|
|
assert not bare.search('logger.info(f"{list(plugin_config.keys())}")')
|