Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add hidden match property handling #1

Draft
wants to merge 22 commits into
base: master
Choose a base branch
from
Draft

Add hidden match property handling #1

wants to merge 22 commits into from

Conversation

mkatychev
Copy link
Owner

@mkatychev mkatychev commented Jun 8, 2021

Store the selector string of any found secret variables so that a sensible diff can be created without leaking secrets.

Description
When request/response mismatch occurs, hidden values (ex. _HIDDEN_VAL) are present in output when not relevant to mismatch.
Steps to Reproduce:

  • Trigger a diff that will still show the leaked value in the actual response:
> _HIDDEN
< leaked_value
Expected Result(s)
> _HIDDEN_SHA_VALUE
< _HIDDEN_SHA_VALUE

Stripe API example:

{
  "cut": {
    "from": [
      "STRIPE_API",
      "_STRIPE_KEY"
    ],
    "to": {
      "STRIPE_TOKEN": "'response'.'body'.'id'"
    }
  },
  "protocol": "HTTP",
  "request": {
    "header": {
      "Authorization": "Bearer ${_STRIPE_KEY}"
    },
    "uri": "POST /v1/tokens",
    "query": {
      "card[number]": 4242424242424242,
      "card[exp_month]": 4,
      "card[exp_year]": 2025,
      "card[cvc]": 314
    },
    "entrypoint": "${STRIPE_API}"
  },
  "response": {
    "validation": {
      "'response'.'body'": {
        "partial": true
      }
    },
    "body": {
      "id": "${_STRIPE_TOKEN}",
       // mismatch fails on a non-hidden value but _STRIPE_TOKEN value will be included in diff
      "something": "else"
    },
    "status": 200
  }
}

Produces this error:

< left / > right
 {
   "body": {
<    "id": "${_STRIPE_TOKEN}",
<    "something": "else"
>    "id": "tok_1J0B3Z2eZvKYlo2CjNjCNDG2"
   },
   "status": 200
 }

@mkatychev mkatychev force-pushed the master branch 2 times, most recently from de05784 to e5fcbde Compare June 9, 2021 20:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant