42 lines
1.4 KiB
Go
42 lines
1.4 KiB
Go
package logging
|
|
|
|
import (
|
|
"bytes"
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestJSONLoggerRedactsSensitiveAttributesAndErrorText(t *testing.T) {
|
|
var output bytes.Buffer
|
|
logger := NewJSONLogger(&output)
|
|
logger.Error("provider fetch failed",
|
|
"password", "password-marker",
|
|
"apiToken", "token-marker",
|
|
"provider_url", "https://user:proxy-secret@example.test/path?api_key=query-secret",
|
|
"error", errors.New("unmarked-secret authorization=header-secret bearer bearer-secret"),
|
|
)
|
|
|
|
text := output.String()
|
|
for _, secret := range []string{"password-marker", "token-marker", "proxy-secret", "query-secret", "unmarked-secret", "header-secret", "bearer-secret"} {
|
|
if strings.Contains(text, secret) {
|
|
t.Fatalf("structured log leaked %q: %s", secret, text)
|
|
}
|
|
}
|
|
if !strings.Contains(text, "[REDACTED]") || !strings.Contains(text, `"msg":"provider fetch failed"`) {
|
|
t.Fatalf("structured log did not preserve message and redaction: %s", text)
|
|
}
|
|
}
|
|
|
|
func TestWriteProcessErrorProducesStructuredRedactedEvent(t *testing.T) {
|
|
var output bytes.Buffer
|
|
WriteProcessError(&output, "proxy-controller", errors.New("unmarked-secret"))
|
|
text := output.String()
|
|
if strings.Contains(text, "unmarked-secret") {
|
|
t.Fatalf("process error was not redacted: %s", text)
|
|
}
|
|
if !strings.Contains(text, `"msg":"process failed"`) || !strings.Contains(text, `"component":"proxy-controller"`) {
|
|
t.Fatalf("process error is not structured: %s", text)
|
|
}
|
|
}
|