mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
Maurice
8e5fdaa877
Permissions cached an empty map before it had loaded, so a DB error during the load cached permissive defaults and every later check answered from that cache - fail-open, and it never expired. The rate limiter grew its per-IP map forever; the GC the legacy version had was dropped in the fold. Idempotency did a check-then-insert, so two concurrent duplicates both ran the handler. Audit rows recorded whatever X-Forwarded-For said, which the client writes, and the request-body debug logger redacted by exact key match - it missed refresh tokens, api keys and PKCE verifiers. FORCE_HTTPS built its redirect from the client's Host header. CSP asked for unsafe-eval on top of the wasm-unsafe-eval it actually needs. The OAuth deny path redirected to an unvalidated URI, ws-token minting had no rate limit at all, and PKCE was skipped when code_verifier was absent rather than refused. An MCP session resumed with a token whose scopes had since been reduced kept the capability set it was created with, and the session cap was checked before the async registration that increments it. Plugin frame containment was lexical, so a symlink out of the directory was never noticed, and instance config accepted keys the manifest never declared.
74 lines
2.8 KiB
TypeScript
74 lines
2.8 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import { redact, SENSITIVE_KEYS } from '../../../src/middleware/globalMiddleware';
|
|
|
|
describe('globalMiddleware request-log redaction', () => {
|
|
it('redacts secretAccessKey (any casing) — storage admin PUT bodies land in the same debug log line', () => {
|
|
expect(redact({ secretAccessKey: 'sk-super-secret' })).toEqual({ secretAccessKey: '[REDACTED]' });
|
|
expect(redact({ SecretAccessKey: 'sk-super-secret' })).toEqual({ SecretAccessKey: '[REDACTED]' });
|
|
expect(redact({ secretaccesskey: 'sk-super-secret' })).toEqual({ secretaccesskey: '[REDACTED]' });
|
|
});
|
|
|
|
it('lists secretaccesskey in the lowercase lookup set (lookup lowercases the key first)', () => {
|
|
expect(SENSITIVE_KEYS.has('secretaccesskey')).toBe(true);
|
|
});
|
|
|
|
it('still redacts every pre-existing sensitive key (no regression)', () => {
|
|
const input = {
|
|
password: 'p',
|
|
new_password: 'p',
|
|
current_password: 'p',
|
|
token: 't',
|
|
jwt: 'j',
|
|
authorization: 'a',
|
|
cookie: 'c',
|
|
client_secret: 's',
|
|
mfa_token: 'm',
|
|
code: '123456',
|
|
smtp_pass: 's',
|
|
};
|
|
const out = redact(input) as Record<string, unknown>;
|
|
for (const key of Object.keys(input)) {
|
|
expect(out[key]).toBe('[REDACTED]');
|
|
}
|
|
});
|
|
|
|
it('redacts nested objects and arrays, leaving non-sensitive fields untouched', () => {
|
|
const out = redact({
|
|
name: 'off-box',
|
|
options: { secretAccessKey: 'sk-1', accessKeyId: 'ak-1' },
|
|
backends: [{ secretAccessKey: 'sk-2' }, { accessKeyId: 'ak-2' }],
|
|
});
|
|
expect(out).toEqual({
|
|
name: 'off-box',
|
|
options: { secretAccessKey: '[REDACTED]', accessKeyId: 'ak-1' },
|
|
backends: [{ secretAccessKey: '[REDACTED]' }, { accessKeyId: 'ak-2' }],
|
|
});
|
|
});
|
|
|
|
it('redacts secret-shaped keys by suffix — the OAuth token body and the settings API keys', () => {
|
|
const out = redact({
|
|
refresh_token: 'rt-1',
|
|
code_verifier: 'cv-1',
|
|
llm_api_key: 'sk-1',
|
|
mapbox_access_token: 'pk-1',
|
|
grant_type: 'refresh_token',
|
|
}) as Record<string, unknown>;
|
|
expect(out.refresh_token).toBe('[REDACTED]');
|
|
expect(out.code_verifier).toBe('[REDACTED]');
|
|
expect(out.llm_api_key).toBe('[REDACTED]');
|
|
expect(out.mapbox_access_token).toBe('[REDACTED]');
|
|
expect(out.grant_type).toBe('refresh_token');
|
|
});
|
|
|
|
it('matches the suffix on the end of the key only, so identifiers stay readable', () => {
|
|
expect(redact({ accessKeyId: 'ak-1', tokenCount: 5 })).toEqual({ accessKeyId: 'ak-1', tokenCount: 5 });
|
|
});
|
|
|
|
it('passes non-object values through untouched', () => {
|
|
expect(redact('plain string')).toBe('plain string');
|
|
expect(redact(42)).toBe(42);
|
|
expect(redact(null)).toBe(null);
|
|
expect(redact(undefined)).toBe(undefined);
|
|
});
|
|
});
|