26 lines
760 B
Go
26 lines
760 B
Go
package middleware
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestSanitizeAuditJSON(t *testing.T) {
|
|
input := `{"username":"operator","password":"secret-value","nested":{"newPassword":"another-secret"},"token":"jwt-value"}`
|
|
got := sanitizeAuditJSON(input)
|
|
for _, secret := range []string{"secret-value", "another-secret", "jwt-value"} {
|
|
if strings.Contains(got, secret) {
|
|
t.Fatalf("sensitive value leaked: %s", got)
|
|
}
|
|
}
|
|
if !strings.Contains(got, "operator") {
|
|
t.Fatalf("non-sensitive context was unexpectedly removed: %s", got)
|
|
}
|
|
}
|
|
|
|
func TestSanitizeAuditJSONRejectsUnstructuredBodies(t *testing.T) {
|
|
if got := sanitizeAuditJSON("password=secret-value"); strings.Contains(got, "secret-value") {
|
|
t.Fatalf("unstructured body leaked: %s", got)
|
|
}
|
|
}
|