|
| 1 | +from __future__ import absolute_import |
| 2 | + |
| 3 | +import textwrap |
| 4 | + |
| 5 | +import pytest |
| 6 | +from mock import MagicMock |
| 7 | +from mock import patch |
| 8 | + |
| 9 | +from detect_secrets.core.constants import VerifiedResult |
| 10 | +from detect_secrets.core.potential_secret import PotentialSecret |
| 11 | +from detect_secrets.plugins.db2 import DB2Detector |
| 12 | +from detect_secrets.plugins.db2 import find_other_factor |
| 13 | +from detect_secrets.plugins.db2 import get_hostname_port_database_from_url |
| 14 | + |
| 15 | + |
| 16 | +DB2_USER = 'fake_user' |
| 17 | +DB2_PASSWORD = 'fake_password' |
| 18 | +DB2_PORT = '1234' |
| 19 | +DB2_HOSTNAME = 'fake.host.name' |
| 20 | +DB2_DATABASE = 'fake_database' |
| 21 | +DB2_CONN_STRING = 'database={DB2_DATABASE};hostname={DB2_HOSTNAME};port={DB2_PORT};' + \ |
| 22 | + 'protocol=tcpip;uid={DB2_USER};pwd={DB2_PASSWORD};ConnectTimeout=5' |
| 23 | +DB2_CONN_STRING = DB2_CONN_STRING.format( |
| 24 | + DB2_DATABASE=DB2_DATABASE, |
| 25 | + DB2_HOSTNAME=DB2_HOSTNAME, |
| 26 | + DB2_PORT=DB2_PORT, |
| 27 | + DB2_USER=DB2_USER, |
| 28 | + DB2_PASSWORD=DB2_PASSWORD, |
| 29 | +) |
| 30 | + |
| 31 | + |
| 32 | +class TestGHDetector(object): |
| 33 | + |
| 34 | + @pytest.mark.parametrize( |
| 35 | + 'token, payload, should_flag', |
| 36 | + [ |
| 37 | + ( |
| 38 | + 'secret', |
| 39 | + 'database=test;hostname=host.test.com;' |
| 40 | + 'port=1;protocol=tcpip;uid=testid;pwd=secret', True, |
| 41 | + ), |
| 42 | + ('$omespeci@!ch@r$', 'dbpwd=$omespeci@!ch@r$', True), |
| 43 | + ('astring', 'db2_password = "astring"', True), |
| 44 | + ('Iusedb2!', '"password": "Iusedb2!"', True), |
| 45 | + ('ilikespaces', 'password = "ilikespaces"', True), |
| 46 | + (':anothersyntax!', 'pwd::anothersyntax!', True), |
| 47 | + ('@#!%#', 'DB2_PASSWORD = "@#!%#"', True), |
| 48 | + ('pass', 'dashdb-password = "pass"', True), |
| 49 | + ('', 'dashdb_host = notapassword', False), |
| 50 | + ('', 'someotherpassword = "doesnt start right"', False), |
| 51 | + ], |
| 52 | + ) |
| 53 | + def test_analyze_string(self, token, payload, should_flag): |
| 54 | + logic = DB2Detector() |
| 55 | + |
| 56 | + output = logic.analyze_string(payload, 1, 'mock_filename') |
| 57 | + assert len(output) == int(should_flag) |
| 58 | + if len(output) > 0: |
| 59 | + assert list(output.keys())[0].secret == token |
| 60 | + |
| 61 | + @patch('detect_secrets.plugins.db2.ibm_db.connect') |
| 62 | + def test_verify_invalid_connect_returns_none(self, mock_db2_connect): |
| 63 | + mock_db2_connect.return_value = None |
| 64 | + |
| 65 | + potential_secret = PotentialSecret('test db2', 'test filename', DB2_PASSWORD) |
| 66 | + assert DB2Detector().verify( |
| 67 | + DB2_PASSWORD, |
| 68 | + '''user={}, |
| 69 | + password={}, |
| 70 | + database={}, |
| 71 | + host={}, |
| 72 | + port={}'''.format(DB2_USER, DB2_PASSWORD, DB2_DATABASE, DB2_HOSTNAME, DB2_PORT), |
| 73 | + potential_secret, |
| 74 | + ) == VerifiedResult.VERIFIED_FALSE |
| 75 | + |
| 76 | + mock_db2_connect.assert_called_with(DB2_CONN_STRING, '', '') |
| 77 | + |
| 78 | + @patch('detect_secrets.plugins.db2.ibm_db.connect') |
| 79 | + def test_verify_invalid_connect_throws_exception(self, mock_db2_connect): |
| 80 | + mock_db2_connect.side_effect = Exception('oops') |
| 81 | + |
| 82 | + potential_secret = PotentialSecret('test db2', 'test filename', DB2_PASSWORD) |
| 83 | + assert DB2Detector().verify( |
| 84 | + DB2_PASSWORD, |
| 85 | + '''user={}, |
| 86 | + password={}, |
| 87 | + database={}, |
| 88 | + host={}, |
| 89 | + port={}'''.format(DB2_USER, DB2_PASSWORD, DB2_DATABASE, DB2_HOSTNAME, DB2_PORT), |
| 90 | + potential_secret, |
| 91 | + ) == VerifiedResult.VERIFIED_FALSE |
| 92 | + |
| 93 | + mock_db2_connect.assert_called_with(DB2_CONN_STRING, '', '') |
| 94 | + |
| 95 | + @patch('detect_secrets.plugins.db2.ibm_db.connect') |
| 96 | + def test_verify_valid_secret(self, mock_db2_connect): |
| 97 | + mock_db2_connect.return_value = MagicMock() |
| 98 | + |
| 99 | + potential_secret = PotentialSecret('test db2', 'test filename', DB2_PASSWORD) |
| 100 | + assert DB2Detector().verify( |
| 101 | + DB2_PASSWORD, |
| 102 | + '''user={}, |
| 103 | + password={}, |
| 104 | + database={}, |
| 105 | + host={}, |
| 106 | + port={}'''.format(DB2_USER, DB2_PASSWORD, DB2_DATABASE, DB2_HOSTNAME, DB2_PORT), |
| 107 | + potential_secret, |
| 108 | + ) == VerifiedResult.VERIFIED_TRUE |
| 109 | + |
| 110 | + mock_db2_connect.assert_called_with(DB2_CONN_STRING, '', '') |
| 111 | + assert potential_secret.other_factors['database'] == DB2_DATABASE |
| 112 | + assert potential_secret.other_factors['hostname'] == DB2_HOSTNAME |
| 113 | + assert potential_secret.other_factors['port'] == DB2_PORT |
| 114 | + assert potential_secret.other_factors['username'] == DB2_USER |
| 115 | + |
| 116 | + @patch('detect_secrets.plugins.db2.ibm_db.connect') |
| 117 | + def test_verify_valid_secret_in_single_quotes(self, mock_db2_connect): |
| 118 | + mock_db2_connect.return_value = MagicMock() |
| 119 | + |
| 120 | + potential_secret = PotentialSecret('test db2', 'test filename', DB2_PASSWORD) |
| 121 | + assert DB2Detector().verify( |
| 122 | + DB2_PASSWORD, |
| 123 | + '''user='{}', |
| 124 | + password='{}', |
| 125 | + database='{}', |
| 126 | + host='{}', |
| 127 | + port='{}' |
| 128 | + '''.format(DB2_USER, DB2_PASSWORD, DB2_DATABASE, DB2_HOSTNAME, DB2_PORT), |
| 129 | + potential_secret, |
| 130 | + ) == VerifiedResult.VERIFIED_TRUE |
| 131 | + |
| 132 | + mock_db2_connect.assert_called_with(DB2_CONN_STRING, '', '') |
| 133 | + assert potential_secret.other_factors['database'] == DB2_DATABASE |
| 134 | + assert potential_secret.other_factors['hostname'] == DB2_HOSTNAME |
| 135 | + assert potential_secret.other_factors['port'] == DB2_PORT |
| 136 | + assert potential_secret.other_factors['username'] == DB2_USER |
| 137 | + |
| 138 | + @patch('detect_secrets.plugins.db2.ibm_db.connect') |
| 139 | + def test_verify_valid_secret_in_double_quotes(self, mock_db2_connect): |
| 140 | + mock_db2_connect.return_value = MagicMock() |
| 141 | + |
| 142 | + potential_secret = PotentialSecret('test db2', 'test filename', DB2_PASSWORD) |
| 143 | + assert DB2Detector().verify( |
| 144 | + DB2_PASSWORD, |
| 145 | + '''user="{}", |
| 146 | + password="{}", |
| 147 | + database="{}", |
| 148 | + host="{}", |
| 149 | + port="{}" |
| 150 | + '''.format(DB2_USER, DB2_PASSWORD, DB2_DATABASE, DB2_HOSTNAME, DB2_PORT), |
| 151 | + potential_secret, |
| 152 | + ) == VerifiedResult.VERIFIED_TRUE |
| 153 | + |
| 154 | + mock_db2_connect.assert_called_with(DB2_CONN_STRING, '', '') |
| 155 | + assert potential_secret.other_factors['database'] == DB2_DATABASE |
| 156 | + assert potential_secret.other_factors['hostname'] == DB2_HOSTNAME |
| 157 | + assert potential_secret.other_factors['port'] == DB2_PORT |
| 158 | + assert potential_secret.other_factors['username'] == DB2_USER |
| 159 | + |
| 160 | + @patch('detect_secrets.plugins.db2.ibm_db.connect') |
| 161 | + def test_verify_from_url(self, mock_db2_connect): |
| 162 | + mock_db2_connect.return_value = MagicMock() |
| 163 | + |
| 164 | + potential_secret = PotentialSecret('test db2', 'test filename', DB2_PASSWORD) |
| 165 | + assert DB2Detector().verify( |
| 166 | + DB2_PASSWORD, |
| 167 | + '''user={}, |
| 168 | + password={}, |
| 169 | + url=jdbc:db2://{}:{}/{}, |
| 170 | + '''.format(DB2_USER, DB2_PASSWORD, DB2_HOSTNAME, DB2_PORT, DB2_DATABASE), |
| 171 | + potential_secret, |
| 172 | + ) == VerifiedResult.VERIFIED_TRUE |
| 173 | + |
| 174 | + mock_db2_connect.assert_called_with(DB2_CONN_STRING, '', '') |
| 175 | + assert potential_secret.other_factors['database'] == DB2_DATABASE |
| 176 | + assert potential_secret.other_factors['hostname'] == DB2_HOSTNAME |
| 177 | + assert potential_secret.other_factors['port'] == DB2_PORT |
| 178 | + assert potential_secret.other_factors['username'] == DB2_USER |
| 179 | + |
| 180 | + @patch('detect_secrets.plugins.db2.ibm_db.connect') |
| 181 | + def test_verify_times_out(self, mock_db2_connect): |
| 182 | + mock_db2_connect.side_effect = Exception('Timeout') |
| 183 | + |
| 184 | + potential_secret = PotentialSecret('test db2', 'test filename', DB2_PASSWORD) |
| 185 | + assert DB2Detector().verify( |
| 186 | + DB2_PASSWORD, |
| 187 | + '''user={}, |
| 188 | + password={}, |
| 189 | + database={}, |
| 190 | + host={}, |
| 191 | + port={}'''.format(DB2_USER, DB2_PASSWORD, DB2_DATABASE, DB2_HOSTNAME, DB2_PORT), |
| 192 | + potential_secret, |
| 193 | + ) == VerifiedResult.UNVERIFIED |
| 194 | + |
| 195 | + mock_db2_connect.assert_called_with(DB2_CONN_STRING, '', '') |
| 196 | + |
| 197 | + def test_verify_no_other_factors(self): |
| 198 | + potential_secret = PotentialSecret('test db2', 'test filename', DB2_PASSWORD) |
| 199 | + assert DB2Detector().verify( |
| 200 | + DB2_PASSWORD, |
| 201 | + 'password={}'.format(DB2_PASSWORD), |
| 202 | + potential_secret, |
| 203 | + ) == VerifiedResult.UNVERIFIED |
| 204 | + |
| 205 | + |
| 206 | +@pytest.mark.parametrize( |
| 207 | + 'content, factor_keyword_regex, factor_regex, expected_output', |
| 208 | + ( |
| 209 | + ( |
| 210 | + textwrap.dedent(""" |
| 211 | + user = {} |
| 212 | + """)[1:-1].format( |
| 213 | + DB2_USER, |
| 214 | + ), |
| 215 | + DB2Detector().username_keyword_regex, |
| 216 | + DB2Detector().username_regex, |
| 217 | + [DB2_USER], |
| 218 | + ), |
| 219 | + ( |
| 220 | + textwrap.dedent(""" |
| 221 | + port = {} |
| 222 | + """)[1:-1].format( |
| 223 | + DB2_PORT, |
| 224 | + ), |
| 225 | + DB2Detector().port_keyword_regex, |
| 226 | + DB2Detector().port_regex, |
| 227 | + [DB2_PORT], |
| 228 | + ), |
| 229 | + ( |
| 230 | + textwrap.dedent(""" |
| 231 | + database = {} |
| 232 | + """)[1:-1].format( |
| 233 | + DB2_DATABASE, |
| 234 | + ), |
| 235 | + DB2Detector().database_keyword_regex, |
| 236 | + DB2Detector().database_regex, |
| 237 | + [DB2_DATABASE], |
| 238 | + ), |
| 239 | + ( |
| 240 | + textwrap.dedent(""" |
| 241 | + host = {} |
| 242 | + """)[1:-1].format( |
| 243 | + DB2_HOSTNAME, |
| 244 | + ), |
| 245 | + DB2Detector().hostname_keyword_regex, |
| 246 | + DB2Detector().hostname_regex, |
| 247 | + [DB2_HOSTNAME], |
| 248 | + ), |
| 249 | + ), |
| 250 | +) |
| 251 | +def test_find_other_factor(content, factor_keyword_regex, factor_regex, expected_output): |
| 252 | + assert find_other_factor(content, factor_keyword_regex, factor_regex) == expected_output |
| 253 | + |
| 254 | + |
| 255 | +@pytest.mark.parametrize( |
| 256 | + 'content, hostname_regex, port_regex, database_regex, expected_output', |
| 257 | + ( |
| 258 | + ( |
| 259 | + textwrap.dedent(""" |
| 260 | + jdbc:db2://{}:{}/{} |
| 261 | + """)[1:-1].format( |
| 262 | + DB2_HOSTNAME, |
| 263 | + DB2_PORT, |
| 264 | + DB2_DATABASE, |
| 265 | + ), |
| 266 | + DB2Detector().hostname_regex, |
| 267 | + DB2Detector().port_regex, |
| 268 | + DB2Detector().database_regex, |
| 269 | + [(DB2_HOSTNAME, DB2_PORT, DB2_DATABASE)], |
| 270 | + ), |
| 271 | + ( |
| 272 | + textwrap.dedent(""" |
| 273 | + jdbc:db2://{}:{}/ |
| 274 | + """)[1:-1].format( |
| 275 | + DB2_HOSTNAME, |
| 276 | + DB2_PORT, |
| 277 | + ), |
| 278 | + DB2Detector().hostname_regex, |
| 279 | + DB2Detector().port_regex, |
| 280 | + DB2Detector().database_regex, |
| 281 | + [], |
| 282 | + ), |
| 283 | + ( |
| 284 | + textwrap.dedent(""" |
| 285 | + nonsense |
| 286 | + """), |
| 287 | + DB2Detector().hostname_regex, |
| 288 | + DB2Detector().port_regex, |
| 289 | + DB2Detector().database_regex, |
| 290 | + [], |
| 291 | + ), |
| 292 | + ), |
| 293 | +) |
| 294 | +def test_get_hostname_port_database_from_url( |
| 295 | + content, hostname_regex, port_regex, database_regex, expected_output, |
| 296 | +): |
| 297 | + assert get_hostname_port_database_from_url( |
| 298 | + content, hostname_regex, port_regex, database_regex, |
| 299 | + ) == expected_output |
0 commit comments