mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-04-14 16:50:04 +00:00
109 lines
3.8 KiB
Python
109 lines
3.8 KiB
Python
from unittest.mock import patch
|
|
|
|
import pytest
|
|
|
|
from prowler.lib.cli.redact import REDACTED_VALUE, get_sensitive_arguments, redact_argv
|
|
|
|
|
|
@pytest.fixture
|
|
def mock_sensitive_args():
|
|
"""Mock get_sensitive_arguments to return a known set."""
|
|
sensitive = frozenset(
|
|
{"--shodan", "--personal-access-token", "--atlas-private-key"}
|
|
)
|
|
with patch(
|
|
"prowler.lib.cli.redact.get_sensitive_arguments", return_value=sensitive
|
|
):
|
|
yield sensitive
|
|
|
|
|
|
class TestRedactArgv:
|
|
def test_empty_argv(self, mock_sensitive_args):
|
|
assert redact_argv([]) == ""
|
|
|
|
def test_no_sensitive_flags(self, mock_sensitive_args):
|
|
argv = ["aws", "--region", "eu-west-1", "--output-formats", "html"]
|
|
assert redact_argv(argv) == "aws --region eu-west-1 --output-formats html"
|
|
|
|
def test_sensitive_flag_with_value(self, mock_sensitive_args):
|
|
argv = ["aws", "--shodan", "abc123"]
|
|
assert redact_argv(argv) == f"aws --shodan {REDACTED_VALUE}"
|
|
|
|
def test_sensitive_flag_with_equals_syntax(self, mock_sensitive_args):
|
|
argv = ["aws", "--shodan=abc123"]
|
|
assert redact_argv(argv) == f"aws --shodan={REDACTED_VALUE}"
|
|
|
|
def test_sensitive_flag_at_end_without_value(self, mock_sensitive_args):
|
|
argv = ["aws", "--shodan"]
|
|
assert redact_argv(argv) == "aws --shodan"
|
|
|
|
def test_sensitive_flag_followed_by_another_flag(self, mock_sensitive_args):
|
|
argv = ["aws", "--shodan", "--region", "eu-west-1"]
|
|
# --region starts with '-', so --shodan value is not redacted (it has no value)
|
|
assert redact_argv(argv) == "aws --shodan --region eu-west-1"
|
|
|
|
def test_multiple_sensitive_flags(self, mock_sensitive_args):
|
|
argv = [
|
|
"github",
|
|
"--personal-access-token",
|
|
"ghp_secret123",
|
|
"--shodan",
|
|
"shodan_key",
|
|
]
|
|
assert (
|
|
redact_argv(argv)
|
|
== f"github --personal-access-token {REDACTED_VALUE} --shodan {REDACTED_VALUE}"
|
|
)
|
|
|
|
def test_mixed_sensitive_and_non_sensitive(self, mock_sensitive_args):
|
|
argv = [
|
|
"mongodbatlas",
|
|
"--atlas-private-key",
|
|
"my_secret",
|
|
"--atlas-project-id",
|
|
"proj123",
|
|
]
|
|
assert (
|
|
redact_argv(argv)
|
|
== f"mongodbatlas --atlas-private-key {REDACTED_VALUE} --atlas-project-id proj123"
|
|
)
|
|
|
|
def test_sensitive_flag_equals_with_other_args(self, mock_sensitive_args):
|
|
argv = [
|
|
"aws",
|
|
"--region",
|
|
"us-east-1",
|
|
"--shodan=key123",
|
|
"--output-formats",
|
|
"html",
|
|
]
|
|
assert (
|
|
redact_argv(argv)
|
|
== f"aws --region us-east-1 --shodan={REDACTED_VALUE} --output-formats html"
|
|
)
|
|
|
|
def test_non_sensitive_flag_with_equals(self, mock_sensitive_args):
|
|
argv = ["aws", "--region=us-east-1"]
|
|
assert redact_argv(argv) == "aws --region=us-east-1"
|
|
|
|
|
|
class TestGetSensitiveArguments:
|
|
def test_discovers_known_sensitive_arguments(self):
|
|
"""Integration test: verify the discovery mechanism finds flags from provider modules."""
|
|
get_sensitive_arguments.cache_clear()
|
|
result = get_sensitive_arguments()
|
|
assert "--shodan" in result
|
|
assert "--personal-access-token" in result
|
|
assert "--oauth-app-token" in result
|
|
assert "--atlas-private-key" in result
|
|
assert "--nhn-password" in result
|
|
assert "--os-password" in result
|
|
|
|
def test_does_not_include_non_sensitive_flags(self):
|
|
"""Verify non-sensitive flags are not in the set."""
|
|
get_sensitive_arguments.cache_clear()
|
|
result = get_sensitive_arguments()
|
|
assert "--region" not in result
|
|
assert "--profile" not in result
|
|
assert "--output-formats" not in result
|