mirror of
https://github.com/ansible-collections/community.general.git
synced 2025-05-30 21:09:09 -07:00
Hide values in json returns which were given in parameters marked no_log.
This commit is contained in:
Toshio Kuratomi
parent
b46ce47a84
commit
c2d188baff
4 changed files with 336 additions and 66 deletions
102
test/units/module_utils/basic/test_heuristic_log_sanitize.py
Normal file
102
test/units/module_utils/basic/test_heuristic_log_sanitize.py
Normal file
|
|
@ -0,0 +1,102 @@
|
|||
# -*- coding: utf-8 -*-
|
||||
# (c) 2015, Toshio Kuratomi <tkuratomi@ansible.com>
|
||||
#
|
||||
# This file is part of Ansible
|
||||
#
|
||||
# Ansible is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Ansible is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
# Make coding more python3-ish
|
||||
from __future__ import (absolute_import, division)
|
||||
__metaclass__ = type
|
||||
|
||||
import sys
|
||||
import syslog
|
||||
|
||||
from ansible.compat.tests import unittest
|
||||
from ansible.compat.tests.mock import patch, MagicMock
|
||||
|
||||
from ansible.module_utils.basic import heuristic_log_sanitize
|
||||
|
||||
class TestHeuristicLogSanitize(unittest.TestCase):
|
||||
def setUp(self):
|
||||
self.URL_SECRET = 'http://username:pas:word@foo.com/data'
|
||||
self.SSH_SECRET = 'username:pas:word@foo.com/data'
|
||||
self.clean_data = repr(self._gen_data(3, True, True, 'no_secret_here'))
|
||||
self.url_data = repr(self._gen_data(3, True, True, self.URL_SECRET))
|
||||
self.ssh_data = repr(self._gen_data(3, True, True, self.SSH_SECRET))
|
||||
|
||||
def _gen_data(self, records, per_rec, top_level, secret_text):
|
||||
hostvars = {'hostvars': {}}
|
||||
for i in range(1, records, 1):
|
||||
host_facts = {'host%s' % i:
|
||||
{'pstack':
|
||||
{'running': '875.1',
|
||||
'symlinked': '880.0',
|
||||
'tars': [],
|
||||
'versions': ['885.0']},
|
||||
}}
|
||||
if per_rec:
|
||||
host_facts['host%s' % i]['secret'] = secret_text
|
||||
hostvars['hostvars'].update(host_facts)
|
||||
if top_level:
|
||||
hostvars['secret'] = secret_text
|
||||
return hostvars
|
||||
|
||||
def test_did_not_hide_too_much(self):
|
||||
self.assertEquals(heuristic_log_sanitize(self.clean_data), self.clean_data)
|
||||
|
||||
def test_hides_url_secrets(self):
|
||||
url_output = heuristic_log_sanitize(self.url_data)
|
||||
# Basic functionality: Successfully hid the password
|
||||
self.assertNotIn('pas:word', url_output)
|
||||
|
||||
# Slightly more advanced, we hid all of the password despite the ":"
|
||||
self.assertNotIn('pas', url_output)
|
||||
|
||||
# In this implementation we replace the password with 8 "*" which is
|
||||
# also the length of our password. The url fields should be able to
|
||||
# accurately detect where the password ends so the length should be
|
||||
# the same:
|
||||
self.assertEqual(len(url_output), len(self.url_data))
|
||||
|
||||
def test_hides_ssh_secrets(self):
|
||||
ssh_output = heuristic_log_sanitize(self.ssh_data)
|
||||
self.assertNotIn('pas:word', ssh_output)
|
||||
|
||||
# Slightly more advanced, we hid all of the password despite the ":"
|
||||
self.assertNotIn('pas', ssh_output)
|
||||
|
||||
# ssh checking is harder as the heuristic is overzealous in many
|
||||
# cases. Since the input will have at least one ":" present before
|
||||
# the password we can tell some things about the beginning and end of
|
||||
# the data, though:
|
||||
self.assertTrue(ssh_output.startswith("{'"))
|
||||
self.assertTrue(ssh_output.endswith("}"))
|
||||
self.assertIn(":********@foo.com/data'", ssh_output)
|
||||
|
||||
|
||||
class TestStripNoLog(unittest.TestCase):
|
||||
def setUp(self):
|
||||
data = ''
|
||||
|
||||
def test_return_strings(self):
|
||||
pass
|
||||
|
||||
def test_strip_no_log(self):
|
||||
pass
|
||||
|
||||
class TestAnsibleModuleStripNoLogValues(unittest.TestCase):
|
||||
pass
|
||||
|
||||
|
||||
151
test/units/module_utils/basic/test_no_log.py
Normal file
151
test/units/module_utils/basic/test_no_log.py
Normal file
|
|
@ -0,0 +1,151 @@
|
|||
# -*- coding: utf-8 -*-
|
||||
# (c) 2015, Toshio Kuratomi <tkuratomi@ansible.com>
|
||||
#
|
||||
# This file is part of Ansible
|
||||
#
|
||||
# Ansible is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Ansible is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
# Make coding more python3-ish
|
||||
from __future__ import (absolute_import, division)
|
||||
__metaclass__ = type
|
||||
|
||||
import json
|
||||
import sys
|
||||
import syslog
|
||||
|
||||
from ansible.compat.tests import unittest
|
||||
from ansible.compat.tests.mock import patch, MagicMock
|
||||
|
||||
from ansible.module_utils import basic
|
||||
from ansible.module_utils.basic import heuristic_log_sanitize
|
||||
from ansible.module_utils.basic import _return_values, _remove_values
|
||||
|
||||
|
||||
class TestReturnValues(unittest.TestCase):
|
||||
dataset = (
|
||||
('string', frozenset(['string'])),
|
||||
('', frozenset()),
|
||||
(1, frozenset(['1'])),
|
||||
(1.0, frozenset(['1.0'])),
|
||||
(False, frozenset()),
|
||||
(['1', '2', '3'], frozenset(['1', '2', '3'])),
|
||||
(('1', '2', '3'), frozenset(['1', '2', '3'])),
|
||||
({'one': 1, 'two': 'dos'}, frozenset(['1', 'dos'])),
|
||||
({'one': 1, 'two': 'dos',
|
||||
'three': ['amigos', 'musketeers', None,
|
||||
{'ping': 'pong', 'base': ('balls', 'raquets')}]},
|
||||
frozenset(['1', 'dos', 'amigos', 'musketeers', 'pong', 'balls', 'raquets'])),
|
||||
)
|
||||
|
||||
def test_return_values(self):
|
||||
for data, expected in self.dataset:
|
||||
self.assertEquals(frozenset(_return_values(data)), expected)
|
||||
|
||||
def test_unknown_type(self):
|
||||
self.assertRaises(TypeError, frozenset, _return_values(object()))
|
||||
|
||||
|
||||
class TestRemoveValues(unittest.TestCase):
|
||||
OMIT = 'VALUE_SPECIFIED_IN_NO_LOG_PARAMETER'
|
||||
dataset_no_remove = (
|
||||
('string', frozenset(['nope'])),
|
||||
(1234, frozenset(['4321'])),
|
||||
(False, frozenset(['4321'])),
|
||||
(1.0, frozenset(['4321'])),
|
||||
(['string', 'strang', 'strung'], frozenset(['nope'])),
|
||||
({'one': 1, 'two': 'dos', 'secret': 'key'}, frozenset(['nope'])),
|
||||
({'one': 1, 'two': 'dos',
|
||||
'three': ['amigos', 'musketeers', None,
|
||||
{'ping': 'pong', 'base': ['balls', 'raquets']}]},
|
||||
frozenset(['nope'])),
|
||||
)
|
||||
dataset_remove = (
|
||||
('string', frozenset(['string']), OMIT),
|
||||
(1234, frozenset(['1234']), OMIT),
|
||||
(1234, frozenset(['23']), OMIT),
|
||||
(1.0, frozenset(['1.0']), OMIT),
|
||||
(['string', 'strang', 'strung'], frozenset(['strang']), ['string', OMIT, 'strung']),
|
||||
(['string', 'strang', 'strung'], frozenset(['strang', 'string', 'strung']), [OMIT, OMIT, OMIT]),
|
||||
(('string', 'strang', 'strung'), frozenset(['string', 'strung']), [OMIT, 'strang', OMIT]),
|
||||
((1234567890, 345678, 987654321), frozenset(['1234567890']), [OMIT, 345678, 987654321]),
|
||||
((1234567890, 345678, 987654321), frozenset(['345678']), [OMIT, OMIT, 987654321]),
|
||||
({'one': 1, 'two': 'dos', 'secret': 'key'}, frozenset(['key']),
|
||||
{'one': 1, 'two': 'dos', 'secret': OMIT}),
|
||||
({'one': 1, 'two': 'dos', 'secret': 'key'}, frozenset(['key', 'dos', '1']),
|
||||
{'one': OMIT, 'two': OMIT, 'secret': OMIT}),
|
||||
({'one': 1, 'two': 'dos', 'secret': 'key'}, frozenset(['key', 'dos', '1']),
|
||||
{'one': OMIT, 'two': OMIT, 'secret': OMIT}),
|
||||
({'one': 1, 'two': 'dos', 'three': ['amigos', 'musketeers', None,
|
||||
{'ping': 'pong', 'base': ['balls', 'raquets']}]},
|
||||
frozenset(['balls', 'base', 'pong', 'amigos']),
|
||||
{'one': 1, 'two': 'dos', 'three': [OMIT, 'musketeers',
|
||||
None, {'ping': OMIT, 'base': [OMIT, 'raquets']}]}),
|
||||
('This sentence has an enigma wrapped in a mystery inside of a secret. - mr mystery',
|
||||
frozenset(['enigma', 'mystery', 'secret']),
|
||||
'This sentence has an ******** wrapped in a ******** inside of a ********. - mr ********'),
|
||||
)
|
||||
|
||||
def test_no_removal(self):
|
||||
for value, no_log_strings in self.dataset_no_remove:
|
||||
self.assertEquals(_remove_values(value, no_log_strings), value)
|
||||
|
||||
def test_strings_to_remove(self):
|
||||
for value, no_log_strings, expected in self.dataset_remove:
|
||||
self.assertEquals(_remove_values(value, no_log_strings), expected)
|
||||
|
||||
def test_unknown_type(self):
|
||||
self.assertRaises(TypeError, _remove_values, object(), frozenset())
|
||||
|
||||
|
||||
@unittest.skipIf(sys.version_info[0] >= 3, "Python 3 is not supported on targets (yet)")
|
||||
class TestAnsibleModuleRemoveNoLogValues(unittest.TestCase):
|
||||
OMIT = 'VALUE_SPECIFIED_IN_NO_LOG_PARAMETER'
|
||||
dataset = (
|
||||
(dict(username='person', password='$ecret k3y'),
|
||||
dict(one=1, pwd='$ecret k3y', url='https://username:password12345@foo.com/login/',
|
||||
not_secret='following the leader'),
|
||||
dict(one=1, pwd=OMIT, url='https://username:password12345@foo.com/login/',
|
||||
not_secret='following the leader')
|
||||
),
|
||||
(dict(username='person', password='password12345'),
|
||||
dict(one=1, pwd='$ecret k3y', url='https://username:password12345@foo.com/login/',
|
||||
not_secret='following the leader'),
|
||||
dict(one=1, pwd='$ecret k3y', url='https://username:********@foo.com/login/',
|
||||
not_secret='following the leader')
|
||||
),
|
||||
(dict(username='person', password='$ecret k3y'),
|
||||
dict(one=1, pwd='$ecret k3y', url='https://username:$ecret k3y@foo.com/login/',
|
||||
not_secret='following the leader'),
|
||||
dict(one=1, pwd=OMIT, url='https://username:********@foo.com/login/',
|
||||
not_secret='following the leader')
|
||||
),
|
||||
)
|
||||
|
||||
def setUp(self):
|
||||
self.COMPLEX_ARGS = basic.MODULE_COMPLEX_ARGS
|
||||
|
||||
def tearDown(self):
|
||||
basic.MODULE_COMPLEX_ARGS = self.COMPLEX_ARGS
|
||||
|
||||
def test_remove_no_log_values(self):
|
||||
for args, return_val, expected in self.dataset:
|
||||
basic.MODULE_COMPLEX_ARGS = json.dumps(args)
|
||||
module = basic.AnsibleModule(
|
||||
argument_spec = dict(
|
||||
username=dict(),
|
||||
password=dict(no_log=True),
|
||||
token=dict(no_log=True),
|
||||
),
|
||||
)
|
||||
self.assertEquals(module.remove_no_log_values(return_val), expected)
|
||||
Loading…
Add table
Add a link
Reference in a new issue