Something went wrong. Try again.
Backend environment for match hosting for lance.blue
Something went wrong. Try again.
Shell
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091#!/usr/bin/env bash# redact() in lib/common.sh is the only thing standing between a malformed or# expired presigned camo/manifest URL and a real credential landing in the# container's log - fetch() pipes a failed download's URL through it before# handing the result to `die`. It had no coverage at all until this file.## Each case pipes a fixture line through redact() in a child shell (a clean# sourcing of common.sh) and checks the credential value is gone while the# rest of the line survives.set -uo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
fail=0check() { # <description> <test-command...> if "${@:2}"; then echo "ok $1"; else echo "FAIL $1"; fail=1; fi}
# redact_line <input> -> redact()'s output for that one lineredact_line() { printf '%s\n' "$1" | \ bash -c 'set -uo pipefail; . "$1"; redact' _ "$ROOT/container/lib/common.sh"}
gone() { bash -c '! grep -qF -- "$2" <<<"$1"' _ "$1" "$2"; } # <output> <secret>present() { bash -c 'grep -qF -- "$2" <<<"$1"' _ "$1" "$2"; } # <output> <substring>
# --- every query-parameter spelling redact() claims to handle ---------------
url="https://bucket.s3.amazonaws.com/manifest.json?X-Amz-Signature=SECRET-AMZ-SIG"out="$(redact_line "$url")"check "X-Amz-Signature's value is gone" gone "$out" "SECRET-AMZ-SIG"check " the marker and the rest survive" present "$out" "X-Amz-Signature=REDACTED"check " the host and path survive" present "$out" "bucket.s3.amazonaws.com/manifest.json"
url="https://cdn.example/camo.png?Signature=SECRET-PLAIN-SIG"out="$(redact_line "$url")"check "Signature's value is gone" gone "$out" "SECRET-PLAIN-SIG"check " the marker survives" present "$out" "Signature=REDACTED"
url="https://cdn.example/camo.png?sig=SECRET-SIG-SHORT"out="$(redact_line "$url")"check "sig's value is gone" gone "$out" "SECRET-SIG-SHORT"check " the marker survives" present "$out" "sig=REDACTED"
url="https://cdn.example/camo.png?token=SECRET-BEARER-TOKEN"out="$(redact_line "$url")"check "token's value is gone" gone "$out" "SECRET-BEARER-TOKEN"check " the marker survives" present "$out" "token=REDACTED"
# --- case-insensitivity -------------------------------------------------------
url="https://cdn.example/camo.png?x-amz-signature=SECRET-LOWER-CASE"out="$(redact_line "$url")"check "a lowercase spelling is still caught" gone "$out" "SECRET-LOWER-CASE"
url="https://cdn.example/camo.png?SIG=SECRET-UPPER-CASE"out="$(redact_line "$url")"check "an uppercase spelling is still caught" gone "$out" "SECRET-UPPER-CASE"
# --- more than one credential in the same URL --------------------------------# A presigned URL commonly carries several of the spellings above at once.# redact()'s prefix used to be unbounded and greedy, so a POSIX leftmost-# longest match spanned every "¶m=value" up to the last recognised one -# every earlier credential value came through untouched, wrapped inside the# part of the match that was kept rather than the part that got REDACTED.url="https://bucket.s3.amazonaws.com/manifest.json?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Signature=SECRET-FIRST&other=value&sig=SECRET-SECOND"out="$(redact_line "$url")"check "the first credential in a multi-credential URL is gone" gone "$out" "SECRET-FIRST"check " and so is the second" gone "$out" "SECRET-SECOND"check " and a plain, non-credential param survives untouched" present "$out" "other=value"
# --- the Authorization header -------------------------------------------------
out="$(redact_line "Authorization: Bearer SECRET-BEARER-HEADER")"check "an Authorization header's value is gone" gone "$out" "SECRET-BEARER-HEADER"check " the field name survives" present "$out" "Authorization: REDACTED"
out="$(redact_line "authorization: Bearer SECRET-LOWER-HEADER")"check "a lowercase 'authorization:' is still caught" gone "$out" "SECRET-LOWER-HEADER"
# --- nothing to redact ---------------------------------------------------------
url="https://cdn.example/camo.png?faction=TraineeA&slot=A"out="$(redact_line "$url")"check "a URL with no credential comes through unchanged" test "$out" = "$url"
echo[ "$fail" -eq 0 ] && echo "all redact() cases passed" || echo "some redact() cases FAILED"exit "$fail"