35 lines
888 B
Go
35 lines
888 B
Go
|
package main
|
||
|
|
|
||
|
|
import (
|
||
|
|
"bytes"
|
||
|
|
"log/slog"
|
||
|
|
"net/url"
|
||
|
|
"strings"
|
||
|
|
"testing"
|
||
|
|
|
||
|
|
"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/config"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestLogListeningOmitsURLCredentials(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
|
||
|
|
// Load rejects such URLs; this proves the log stays safe even if one
|
||
|
|
// reached the Config some other way.
|
||
|
|
u, err := url.Parse("https://alice:hunter2@meals.example.com/app?token=t0ken")
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
var buf bytes.Buffer
|
||
|
|
logListening(slog.New(slog.NewJSONHandler(&buf, nil)), config.Config{HTTPAddr: ":8080", PublicURL: u})
|
||
|
|
|
||
|
|
out := buf.String()
|
||
|
|
for _, leak := range []string{"alice", "hunter2", "t0ken"} {
|
||
|
|
if strings.Contains(out, leak) {
|
||
|
|
t.Errorf("startup log leaks %q: %s", leak, out)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if !strings.Contains(out, `"public_origin":"https://meals.example.com"`) {
|
||
|
|
t.Errorf("startup log missing public origin: %s", out)
|
||
|
|
}
|
||
|
|
}
|