dev_agent
e3d8c4d73d
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
35 lines
888 B
Go
35 lines
888 B
Go
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"log/slog"
|
|
"net/url"
|
|
"strings"
|
|
"testing"
|
|
|
|
"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/config"
|
|
)
|
|
|
|
func TestLogListeningOmitsURLCredentials(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// Load rejects such URLs; this proves the log stays safe even if one
|
|
// reached the Config some other way.
|
|
u, err := url.Parse("https://alice:hunter2@meals.example.com/app?token=t0ken")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var buf bytes.Buffer
|
|
logListening(slog.New(slog.NewJSONHandler(&buf, nil)), config.Config{HTTPAddr: ":8080", PublicURL: u})
|
|
|
|
out := buf.String()
|
|
for _, leak := range []string{"alice", "hunter2", "t0ken"} {
|
|
if strings.Contains(out, leak) {
|
|
t.Errorf("startup log leaks %q: %s", leak, out)
|
|
}
|
|
}
|
|
if !strings.Contains(out, `"public_origin":"https://meals.example.com"`) {
|
|
t.Errorf("startup log missing public origin: %s", out)
|
|
}
|
|
}
|