github.com/arunkumar7540/cli@v6.45.0+incompatible/cf/net/request_dumper_test.go (about)

     1  package net_test
     2  
     3  import (
     4  	"bytes"
     5  	"net/http"
     6  	"strings"
     7  
     8  	. "code.cloudfoundry.org/cli/cf/net"
     9  	"code.cloudfoundry.org/cli/cf/trace"
    10  	. "github.com/onsi/ginkgo"
    11  	. "github.com/onsi/gomega"
    12  )
    13  
    14  var _ = Describe("RequestDumper", func() {
    15  	Describe("DumpRequest", func() {
    16  		var (
    17  			printer trace.Printer
    18  			buffer  *bytes.Buffer
    19  			dumper  RequestDumper
    20  		)
    21  
    22  		BeforeEach(func() {
    23  			buffer = new(bytes.Buffer)
    24  			printer = trace.NewWriterPrinter(buffer, false)
    25  			dumper = NewRequestDumper(printer)
    26  		})
    27  
    28  		When("the request body is JSON", func() {
    29  			var (
    30  				request *http.Request
    31  				reqErr  error
    32  			)
    33  
    34  			BeforeEach(func() {
    35  				bodyString := `{"password":"verysecret","some-field":"some-value"}`
    36  				request, reqErr = http.NewRequest("GET", "example.com", strings.NewReader(bodyString))
    37  				request.Header.Set("Content-Type", "application/json")
    38  				request.Header.Set("Authorization", "bearer: some-secret-token")
    39  				Expect(reqErr).ToNot(HaveOccurred())
    40  			})
    41  
    42  			JustBeforeEach(func() {
    43  				dumper.DumpRequest(request)
    44  			})
    45  
    46  			It("redacts values from the key 'password'", func() {
    47  				Expect(buffer.String()).To(ContainSubstring("password"))
    48  				Expect(buffer.String()).ToNot(ContainSubstring("verysecret"))
    49  			})
    50  
    51  			It("redacts the authorization header", func() {
    52  				Expect(buffer.String()).To(ContainSubstring("Authorization"))
    53  				Expect(buffer.String()).ToNot(ContainSubstring("some-secret-token"))
    54  			})
    55  		})
    56  
    57  		When("the request body is x-www-form-urlencoded", func() {
    58  			var (
    59  				request *http.Request
    60  				reqErr  error
    61  			)
    62  
    63  			BeforeEach(func() {
    64  				bodyString := `grant_type=password&password=somesecret&scope=&username=admin&refresh_token=secret-refresh-token&access_token=secret-access-token`
    65  				request, reqErr = http.NewRequest("GET", "example.com", strings.NewReader(bodyString))
    66  				request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
    67  				request.Header.Set("Authorization", "bearer: some-secret-token")
    68  				Expect(reqErr).ToNot(HaveOccurred())
    69  			})
    70  
    71  			JustBeforeEach(func() {
    72  				dumper.DumpRequest(request)
    73  			})
    74  
    75  			It("redacts the value from keys called 'password'", func() {
    76  				Expect(buffer.String()).To(ContainSubstring("password"))
    77  				Expect(buffer.String()).ToNot(ContainSubstring("somesecret"))
    78  			})
    79  
    80  			It("redacts the authorization header", func() {
    81  				Expect(buffer.String()).To(ContainSubstring("Authorization: "))
    82  				Expect(buffer.String()).ToNot(ContainSubstring("some-secret-token"))
    83  			})
    84  
    85  			It("redacts fields containing 'token'", func() {
    86  				Expect(buffer.String()).To(ContainSubstring("refresh_token="))
    87  				Expect(buffer.String()).ToNot(ContainSubstring("secret-refresh-token"))
    88  				Expect(buffer.String()).To(ContainSubstring("access_token="))
    89  				Expect(buffer.String()).ToNot(ContainSubstring("secret-access-token"))
    90  			})
    91  		})
    92  	})
    93  })