eric/narratio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 15 Wiki Activity

Redact and cap subprocess diagnostics

Browse Source
This commit is contained in:
Eric Rakestraw
2026-08-10 18:55:49 +00:00
parent 7bd575187e
commit 60cebf0e4b
15 changed files with 675 additions and 237 deletions
Download Patch File Download Diff File Expand all files Collapse all files

175
internal/adapters/subprocess/run_test.go
View File

@@ -1,10 +1,12 @@
package subprocess
import (
"bytes"
"context"
"os"
"os/exec"
"path/filepath"
"strconv"
"strings"
"testing"
"time"
@@ -121,6 +123,132 @@ func TestRunFailureRedactsSensitiveTail(t *testing.T) {
if !strings.Contains(err.Error(), "<redacted>") {
t.Fatalf("error = %q, want redacted stderr tail marker", err.Error())
}
for _, path := range []string{req.StdoutLogPath, req.StderrLogPath} {
data, readErr := os.ReadFile(path)
if readErr != nil {
t.Fatalf("read diagnostic %q: %v", path, readErr)
}
if strings.Contains(string(data), secretValue) {
t.Fatalf("diagnostic %q leaked secret: %q", path, data)
}
}
}
func TestRunRedactsInheritedSensitiveEnvironment(t *testing.T) {
exe, err := os.Executable()
if err != nil {
t.Fatalf("os.Executable() error = %v", err)
}
secretValue := "inherited-secret-value"
t.Setenv("OPENROUTER_API_KEY", secretValue)
dir := t.TempDir()
req := RunRequest{
Executable: exe,
Args: []string{"-test.run=TestSubprocessHelper", "--", "echoenv"},
EnvOverrides: map[string]string{
"GO_WANT_SUBPROCESS_HELPER": "1",
"SUBPROCESS_HELPER_ENV_KEY": "OPENROUTER_API_KEY",
},
StdoutLogPath: filepath.Join(dir, "stdout.log"),
StderrLogPath: filepath.Join(dir, "stderr.log"),
}
_, err = Run(context.Background(), req)
if err == nil {
t.Fatal("Run() error = nil, want non-nil")
}
if strings.Contains(err.Error(), secretValue) {
t.Fatalf("error leaked inherited secret: %q", err)
}
for _, path := range []string{req.StdoutLogPath, req.StderrLogPath} {
data, readErr := os.ReadFile(path)
if readErr != nil {
t.Fatalf("read diagnostic %q: %v", path, readErr)
}
if strings.Contains(string(data), secretValue) {
t.Fatalf("diagnostic %q leaked inherited secret: %q", path, data)
}
}
}
func TestRunRedactsSensitiveOutputAndErrorTail(t *testing.T) {
exe, err := os.Executable()
if err != nil {
t.Fatalf("os.Executable() error = %v", err)
}
secretValue := "override-secret-value"
dir := t.TempDir()
req := RunRequest{
Executable: exe,
Args: []string{"-test.run=TestSubprocessHelper", "--", "echoenv"},
EnvOverrides: map[string]string{
"GO_WANT_SUBPROCESS_HELPER": "1",
"SUBPROCESS_HELPER_ENV_KEY": "OPENROUTER_API_KEY",
"OPENROUTER_API_KEY": secretValue,
},
StdoutLogPath: filepath.Join(dir, "stdout.log"),
StderrLogPath: filepath.Join(dir, "stderr.log"),
}
_, err = Run(context.Background(), req)
if err == nil {
t.Fatal("Run() error = nil, want non-nil")
}
if strings.Contains(err.Error(), secretValue) || !strings.Contains(err.Error(), "<redacted>") {
t.Fatalf("error = %q, want redacted secret", err)
}
for _, path := range []string{req.StdoutLogPath, req.StderrLogPath} {
data, readErr := os.ReadFile(path)
if readErr != nil {
t.Fatalf("read diagnostic %q: %v", path, readErr)
}
if strings.Contains(string(data), secretValue) || !strings.Contains(string(data), "<redacted>") {
t.Fatalf("diagnostic %q = %q, want redacted secret", path, data)
}
}
}
func TestStreamRedactorHandlesSplitAndOverlappingSecrets(t *testing.T) {
redactor := newStreamRedactor([]string{"abc", "abcde", "cde", ""})
var output bytes.Buffer
output.Write(redactor.Write([]byte("start-ab")))
output.Write(redactor.Write([]byte("cde-end")))
output.Write(redactor.Flush())
if got := output.String(); got != "start-<redacted>-end" {
t.Fatalf("redacted output = %q, want one redacted marker", got)
}
}
func TestDiagnosticWriterHonorsExactLimitAndCapPlusOne(t *testing.T) {
exactLogs := &logWriters{limits: make(chan *captureLimitError, 1)}
var exactOutput bytes.Buffer
exact := newDiagnosticWriter(exactLogs, "stdout", "test", &exactOutput, 5, nil)
if _, err := exact.Write([]byte("abcde")); err != nil {
t.Fatalf("exact Write() error = %v", err)
}
if err := exact.Flush(); err != nil {
t.Fatalf("exact Flush() error = %v", err)
}
if got := exactOutput.String(); got != "abcde" {
t.Fatalf("exact output = %q, want abcde", got)
}
if exactLogs.Limit() != nil {
t.Fatal("exact write recorded a capture limit")
}
cappedLogs := &logWriters{limits: make(chan *captureLimitError, 1)}
var cappedOutput bytes.Buffer
capped := newDiagnosticWriter(cappedLogs, "stderr", "test", &cappedOutput, 5, nil)
if _, err := capped.Write([]byte("abcdef")); err == nil {
t.Fatal("cap-plus-one Write() error = nil, want capture limit")
}
if err := capped.Flush(); err != nil {
t.Fatalf("cap-plus-one Flush() error = %v", err)
}
if got := cappedOutput.String(); got != "abcde" {
t.Fatalf("capped output = %q, want abcde", got)
}
if limit := cappedLogs.Limit(); limit == nil || limit.stream != "stderr" || limit.limit != 5 {
t.Fatalf("capture limit = %#v, want stderr limit 5", limit)
}
}
func TestRunFailureAddsBadDescriptorHint(t *testing.T) {
@@ -185,15 +313,14 @@ func TestRunInheritsParentEnvironmentByDefault(t *testing.T) {
t.Fatalf("os.Executable() error = %v", err)
}
t.Setenv("GO_WANT_SUBPROCESS_HELPER", "1")
t.Setenv("SUBPROCESS_HELPER_ENV_KEY", "SUBPROCESS_PARENT_VALUE")
t.Setenv("SUBPROCESS_PARENT_VALUE", "inherited-value")
t.Setenv("PATH", "inherited-value")
dir := t.TempDir()
stdoutPath := filepath.Join(dir, "stdout.log")
req := RunRequest{
Executable: exe,
Args: []string{"-test.run=TestSubprocessHelper", "--", "printenv"},
EnvOverrides: map[string]string{"GO_WANT_SUBPROCESS_HELPER": "1", "SUBPROCESS_HELPER_ENV_KEY": "PATH"},
StdoutLogPath: stdoutPath,
}
@@ -215,16 +342,16 @@ func TestRunEnvOverridesWinOverInheritedValues(t *testing.T) {
t.Fatalf("os.Executable() error = %v", err)
}
t.Setenv("GO_WANT_SUBPROCESS_HELPER", "1")
t.Setenv("SUBPROCESS_HELPER_ENV_KEY", "SUBPROCESS_PARENT_VALUE")
t.Setenv("SUBPROCESS_PARENT_VALUE", "parent-value")
dir := t.TempDir()
stdoutPath := filepath.Join(dir, "stdout.log")
req := RunRequest{
Executable: exe,
Args: []string{"-test.run=TestSubprocessHelper", "--", "printenv"},
EnvOverrides: map[string]string{"SUBPROCESS_PARENT_VALUE": "override-value"},
Executable: exe,
Args: []string{"-test.run=TestSubprocessHelper", "--", "printenv"},
EnvOverrides: map[string]string{
"GO_WANT_SUBPROCESS_HELPER": "1",
"SUBPROCESS_HELPER_ENV_KEY": "SUBPROCESS_PARENT_VALUE",
"SUBPROCESS_PARENT_VALUE": "override-value",
},
StdoutLogPath: stdoutPath,
}
@@ -369,6 +496,34 @@ func TestSubprocessHelper(t *testing.T) {
key := os.Getenv("SUBPROCESS_HELPER_ENV_KEY")
_, _ = os.Stdout.WriteString(os.Getenv(key) + "\n")
os.Exit(0)
case "echoenv":
key := os.Getenv("SUBPROCESS_HELPER_ENV_KEY")
value := os.Getenv(key)
_, _ = os.Stdout.WriteString(value)
_, _ = os.Stderr.WriteString(value)
os.Exit(5)
case "spam":
chunk := strings.Repeat("x", 64*1024)
count, _ := strconv.Atoi(os.Getenv("SUBPROCESS_HELPER_CHUNKS"))
for range count {
_, _ = os.Stdout.WriteString(chunk)
}
os.Exit(0)
case "tree-spam":
descendant := exec.Command(os.Args[0], "-test.run=^TestSubprocessHelper$", "--", "descendant")
descendant.Env = append(os.Environ(), "GO_WANT_SUBPROCESS_HELPER=1")
descendant.Stdout = os.Stdout
descendant.Stderr = os.Stderr
if err := descendant.Start(); err != nil {
os.Exit(3)
}
if err := os.WriteFile(os.Getenv("SUBPROCESS_HELPER_READY_PATH"), []byte("ready"), 0o600); err != nil {
os.Exit(4)
}
chunk := strings.Repeat("x", 64*1024)
for {
_, _ = os.Stdout.WriteString(chunk)
}
case "tree":
descendant := exec.Command(os.Args[0], "-test.run=^TestSubprocessHelper$", "--", "descendant")
descendant.Env = append(os.Environ(), "GO_WANT_SUBPROCESS_HELPER=1")