fix(sdk): redact sensitive CLI flags in HTML output (#10518)

tests/lib/cli/redact_test.py

@@ -0,0 +1,108 @@
+from unittest.mock import patch
+
+import pytest
+
+from prowler.lib.cli.redact import REDACTED_VALUE, get_sensitive_arguments, redact_argv
+
+
+@pytest.fixture
+def mock_sensitive_args():
+    """Mock get_sensitive_arguments to return a known set."""
+    sensitive = frozenset(
+        {"--shodan", "--personal-access-token", "--atlas-private-key"}
+    )
+    with patch(
+        "prowler.lib.cli.redact.get_sensitive_arguments", return_value=sensitive
+    ):
+        yield sensitive
+
+
+class TestRedactArgv:
+    def test_empty_argv(self, mock_sensitive_args):
+        assert redact_argv([]) == ""
+
+    def test_no_sensitive_flags(self, mock_sensitive_args):
+        argv = ["aws", "--region", "eu-west-1", "--output-formats", "html"]
+        assert redact_argv(argv) == "aws --region eu-west-1 --output-formats html"
+
+    def test_sensitive_flag_with_value(self, mock_sensitive_args):
+        argv = ["aws", "--shodan", "abc123"]
+        assert redact_argv(argv) == f"aws --shodan {REDACTED_VALUE}"
+
+    def test_sensitive_flag_with_equals_syntax(self, mock_sensitive_args):
+        argv = ["aws", "--shodan=abc123"]
+        assert redact_argv(argv) == f"aws --shodan={REDACTED_VALUE}"
+
+    def test_sensitive_flag_at_end_without_value(self, mock_sensitive_args):
+        argv = ["aws", "--shodan"]
+        assert redact_argv(argv) == "aws --shodan"
+
+    def test_sensitive_flag_followed_by_another_flag(self, mock_sensitive_args):
+        argv = ["aws", "--shodan", "--region", "eu-west-1"]
+        # --region starts with '-', so --shodan value is not redacted (it has no value)
+        assert redact_argv(argv) == "aws --shodan --region eu-west-1"
+
+    def test_multiple_sensitive_flags(self, mock_sensitive_args):
+        argv = [
+            "github",
+            "--personal-access-token",
+            "ghp_secret123",
+            "--shodan",
+            "shodan_key",
+        ]
+        assert (
+            redact_argv(argv)
+            == f"github --personal-access-token {REDACTED_VALUE} --shodan {REDACTED_VALUE}"
+        )
+
+    def test_mixed_sensitive_and_non_sensitive(self, mock_sensitive_args):
+        argv = [
+            "mongodbatlas",
+            "--atlas-private-key",
+            "my_secret",
+            "--atlas-project-id",
+            "proj123",
+        ]
+        assert (
+            redact_argv(argv)
+            == f"mongodbatlas --atlas-private-key {REDACTED_VALUE} --atlas-project-id proj123"
+        )
+
+    def test_sensitive_flag_equals_with_other_args(self, mock_sensitive_args):
+        argv = [
+            "aws",
+            "--region",
+            "us-east-1",
+            "--shodan=key123",
+            "--output-formats",
+            "html",
+        ]
+        assert (
+            redact_argv(argv)
+            == f"aws --region us-east-1 --shodan={REDACTED_VALUE} --output-formats html"
+        )
+
+    def test_non_sensitive_flag_with_equals(self, mock_sensitive_args):
+        argv = ["aws", "--region=us-east-1"]
+        assert redact_argv(argv) == "aws --region=us-east-1"
+
+
+class TestGetSensitiveArguments:
+    def test_discovers_known_sensitive_arguments(self):
+        """Integration test: verify the discovery mechanism finds flags from provider modules."""
+        get_sensitive_arguments.cache_clear()
+        result = get_sensitive_arguments()
+        assert "--shodan" in result
+        assert "--personal-access-token" in result
+        assert "--oauth-app-token" in result
+        assert "--atlas-private-key" in result
+        assert "--nhn-password" in result
+        assert "--os-password" in result
+
+    def test_does_not_include_non_sensitive_flags(self):
+        """Verify non-sensitive flags are not in the set."""
+        get_sensitive_arguments.cache_clear()
+        result = get_sensitive_arguments()
+        assert "--region" not in result
+        assert "--profile" not in result
+        assert "--output-formats" not in result

tests/lib/outputs/html/html_test.py

@@ -4,6 +4,7 @@ from io import StringIO
 from mock import MagicMock, patch
 
 from prowler.config.config import prowler_version, timestamp
+from prowler.lib.cli.redact import redact_argv
 from prowler.lib.logger import logger
 from prowler.lib.outputs.html.html import HTML
 from prowler.providers.github.models import GithubAppIdentityInfo
@@ -473,7 +474,7 @@ def get_aws_html_header(args: list) -> str:
                 </div>
                 </li>
                 <li class="list-group-item">
-                <b>Parameters used:</b> {" ".join(args)}
+                <b>Parameters used:</b> {redact_argv(args)}
                 </li>
                 <li class="list-group-item">
                 <b>Date:</b> {timestamp.isoformat()}