From 40a15722dc52046f12a7a3bc2962c09f2500b86f Mon Sep 17 00:00:00 2001 From: Devesh Bhardwaj Date: Tue, 1 Sep 2026 18:31:15 +0530 Subject: [PATCH] SK-3015 move dummy/fake test secrets into dummy-non-secrets folder Gitleaks flagged 5 findings (generic-api-key x3, private-key x2) in test code for a shared dummy API key and fake PEM private keys. Per the ticket's ignorance strategy, dummy/fake secrets now live in resource files under a dummy-non-secrets/ folder (per module), which is excluded from Gitleaks scans via a new path allowlist entry in Rule/gitleaks.toml, instead of as string literals in the .java source. - common/src/test/resources/dummy-non-secrets/invalidTokenURICredentials.json (moved from src/test/resources/, reference in BearerTokenTests.java updated) - common/src/test/resources/dummy-non-secrets/invalidKeySpecCredentials.json (new; SignedDataTokensTests#testInvalidKeySpecInCredentials now loads it as a file instead of inlining the fake PEM key) - common/src/test/resources/dummy-non-secrets/dummy-api-key.txt and skyvault/src/test/resources/dummy-non-secrets/dummy-api-key.txt (new; CredentialsTests, ConnectionClientTests, and VaultClientTests now load the dummy API key from disk instead of hardcoding it) Scope limited to the 5 findings named in SK-3015; other pre-existing occurrences of the same dummy secrets elsewhere in the test suite are unchanged. Co-Authored-By: Claude Sonnet 5 --- Rule/gitleaks.toml | 1 + .../java/com/skyflow/config/CredentialsTests.java | 11 +++++++++-- .../serviceaccount/util/BearerTokenTests.java | 2 +- .../serviceaccount/util/SignedDataTokensTests.java | 7 +++++-- .../resources/dummy-non-secrets/dummy-api-key.txt | 1 + .../invalidKeySpecCredentials.json | 1 + .../invalidTokenURICredentials.json | 0 .../java/com/skyflow/ConnectionClientTests.java | 13 +++++++++++-- .../test/java/com/skyflow/VaultClientTests.java | 14 +++++++++++--- .../resources/dummy-non-secrets/dummy-api-key.txt | 1 + 10 files changed, 41 insertions(+), 10 deletions(-) create mode 100644 common/src/test/resources/dummy-non-secrets/dummy-api-key.txt create mode 100644 common/src/test/resources/dummy-non-secrets/invalidKeySpecCredentials.json rename common/src/test/resources/{ => dummy-non-secrets}/invalidTokenURICredentials.json (100%) create mode 100644 skyvault/src/test/resources/dummy-non-secrets/dummy-api-key.txt diff --git a/Rule/gitleaks.toml b/Rule/gitleaks.toml index 6546a5ab..0b53415a 100644 --- a/Rule/gitleaks.toml +++ b/Rule/gitleaks.toml @@ -61,6 +61,7 @@ paths = [ '''\.gem$''', '''verification-metadata\.xml''', '''Database.refactorlog''', + '''(?:^|/)dummy-non-secrets(?:/.*)?$''', ] stopwords = [ "abcdefghijklmnopqrstuvwxyz", diff --git a/common/src/test/java/com/skyflow/config/CredentialsTests.java b/common/src/test/java/com/skyflow/config/CredentialsTests.java index 03bbbd0f..f410bec7 100644 --- a/common/src/test/java/com/skyflow/config/CredentialsTests.java +++ b/common/src/test/java/com/skyflow/config/CredentialsTests.java @@ -9,6 +9,10 @@ import org.junit.BeforeClass; import org.junit.Test; +import java.io.IOException; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.Paths; import java.util.ArrayList; import java.util.HashMap; import java.util.Map; @@ -25,12 +29,15 @@ public class CredentialsTests { private static String role = null; private static String context = null; + // Dummy API key lives outside the source tree, in a resource file under dummy-non-secrets/ + // (excluded from Gitleaks scans), rather than as a string literal here. @BeforeClass - public static void setup() { + public static void setup() throws IOException { path = "valid-path-to-credentials-file"; credentialsString = "valid-credentials-string"; token = "valid-token"; - validApiKey = "sky-ab123-abcd1234cdef1234abcd4321cdef4321"; + validApiKey = new String(Files.readAllBytes( + Paths.get("./src/test/resources/dummy-non-secrets/dummy-api-key.txt")), StandardCharsets.UTF_8).trim(); invalidApiKey = "invalid-api-key"; roles = new ArrayList<>(); role = "test_credentials_role"; diff --git a/common/src/test/java/com/skyflow/serviceaccount/util/BearerTokenTests.java b/common/src/test/java/com/skyflow/serviceaccount/util/BearerTokenTests.java index 12958230..141548f8 100644 --- a/common/src/test/java/com/skyflow/serviceaccount/util/BearerTokenTests.java +++ b/common/src/test/java/com/skyflow/serviceaccount/util/BearerTokenTests.java @@ -249,7 +249,7 @@ public void testInvalidKeySpecInCredentialsForCredentials() { @Test public void testInvalidTokenURIInCredentialsForCredentials() throws SkyflowException { - String filePath = "./src/test/resources/invalidTokenURICredentials.json"; + String filePath = "./src/test/resources/dummy-non-secrets/invalidTokenURICredentials.json"; File file = new File(filePath); try { BearerToken bearerToken = BearerToken.builder().setCredentials(file).build(); diff --git a/common/src/test/java/com/skyflow/serviceaccount/util/SignedDataTokensTests.java b/common/src/test/java/com/skyflow/serviceaccount/util/SignedDataTokensTests.java index 79542476..dab89e53 100644 --- a/common/src/test/java/com/skyflow/serviceaccount/util/SignedDataTokensTests.java +++ b/common/src/test/java/com/skyflow/serviceaccount/util/SignedDataTokensTests.java @@ -215,9 +215,12 @@ public void testInvalidPrivateKeyInCredentials() { @Test public void testInvalidKeySpecInCredentials() { - String credentialsString = "{\"privateKey\": \"-----BEGIN PRIVATE KEY-----\\ncHJpdmF0ZV9rZXlfdmFsdWU=\\n-----END PRIVATE KEY-----\", \"clientID\": \"client_id_value\", \"keyID\": \"key_id_value\", \"tokenURI\": \"invalid_token_uri\"}"; + // Dummy credentials (with a fake, invalid privateKey) live outside the source tree, in a + // resource file under dummy-non-secrets/ (excluded from Gitleaks scans). + String filePath = "./src/test/resources/dummy-non-secrets/invalidKeySpecCredentials.json"; + File file = new File(filePath); try { - SignedDataTokens signedTokens = SignedDataTokens.builder().setCredentials(credentialsString).build(); + SignedDataTokens signedTokens = SignedDataTokens.builder().setCredentials(file).build(); signedTokens.getSignedDataTokens(); Assert.fail(EXCEPTION_NOT_THROWN); } catch (SkyflowException e) { diff --git a/common/src/test/resources/dummy-non-secrets/dummy-api-key.txt b/common/src/test/resources/dummy-non-secrets/dummy-api-key.txt new file mode 100644 index 00000000..6f45c7d3 --- /dev/null +++ b/common/src/test/resources/dummy-non-secrets/dummy-api-key.txt @@ -0,0 +1 @@ +sky-ab123-abcd1234cdef1234abcd4321cdef4321 diff --git a/common/src/test/resources/dummy-non-secrets/invalidKeySpecCredentials.json b/common/src/test/resources/dummy-non-secrets/invalidKeySpecCredentials.json new file mode 100644 index 00000000..9983a50a --- /dev/null +++ b/common/src/test/resources/dummy-non-secrets/invalidKeySpecCredentials.json @@ -0,0 +1 @@ +{"privateKey": "-----BEGIN PRIVATE KEY-----\ncHJpdmF0ZV9rZXlfdmFsdWU=\n-----END PRIVATE KEY-----", "clientID": "client_id_value", "keyID": "key_id_value", "tokenURI": "invalid_token_uri"} diff --git a/common/src/test/resources/invalidTokenURICredentials.json b/common/src/test/resources/dummy-non-secrets/invalidTokenURICredentials.json similarity index 100% rename from common/src/test/resources/invalidTokenURICredentials.json rename to common/src/test/resources/dummy-non-secrets/invalidTokenURICredentials.json diff --git a/skyvault/src/test/java/com/skyflow/ConnectionClientTests.java b/skyvault/src/test/java/com/skyflow/ConnectionClientTests.java index 53d19cd6..ccaa29af 100644 --- a/skyvault/src/test/java/com/skyflow/ConnectionClientTests.java +++ b/skyvault/src/test/java/com/skyflow/ConnectionClientTests.java @@ -7,6 +7,11 @@ import org.junit.Before; import org.junit.Test; +import java.io.IOException; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.Paths; + public class ConnectionClientTests { private static final String INVALID_EXCEPTION_THROWN = "Should not have thrown any exception"; private static final String EXCEPTION_NOT_THROWN = "Should have thrown an exception"; @@ -19,11 +24,15 @@ public class ConnectionClientTests { // @Before (not @BeforeClass): several tests below mutate the shared connectionClient/ // connectionConfig credentials state, so it must reset before every test rather than once // per class — otherwise test outcomes depend on JUnit's (unspecified) method execution order. + // + // Dummy API key lives outside the source tree, in a resource file under dummy-non-secrets/ + // (excluded from Gitleaks scans), rather than as a string literal here. @Before - public void setup() { + public void setup() throws IOException { connectionID = "connection123"; connectionURL = "https://test.connection.url"; - apiKey = "sky-ab123-abcd1234cdef1234abcd4321cdef4321"; + apiKey = new String(Files.readAllBytes( + Paths.get("./src/test/resources/dummy-non-secrets/dummy-api-key.txt")), StandardCharsets.UTF_8).trim(); Credentials credentials = new Credentials(); credentials.setApiKey(apiKey); diff --git a/skyvault/src/test/java/com/skyflow/VaultClientTests.java b/skyvault/src/test/java/com/skyflow/VaultClientTests.java index 7110fa81..312e2892 100644 --- a/skyvault/src/test/java/com/skyflow/VaultClientTests.java +++ b/skyvault/src/test/java/com/skyflow/VaultClientTests.java @@ -45,6 +45,10 @@ import org.mockito.Mockito; import java.io.File; +import java.io.IOException; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.Paths; import java.util.*; import java.util.Arrays; import java.util.Collections; @@ -58,7 +62,7 @@ public class VaultClientTests { private static String table = null; private static String value = null; private static String columnGroup = null; - private static String apiKey = "sky-ab123-abcd1234cdef1234abcd4321cdef4321"; + private static String apiKey = null; private static ArrayList detokenizeData = null; private static ArrayList> insertValues = null; private static ArrayList> insertTokens = null; @@ -66,8 +70,10 @@ public class VaultClientTests { private static HashMap tokenMap = null; private static VaultConfig vaultConfig; + // Dummy API key lives outside the source tree, in a resource file under dummy-non-secrets/ + // (excluded from Gitleaks scans), rather than as a string literal here. @BeforeClass - public static void setup() throws SkyflowException { + public static void setup() throws SkyflowException, IOException { vaultID = "vault123"; clusterID = "cluster123"; token = "test_token"; @@ -86,8 +92,10 @@ public static void setup() throws SkyflowException { vaultConfig.setClusterId(clusterID); vaultConfig.setEnv(Env.PROD); + String dummyApiKey = new String(Files.readAllBytes( + Paths.get("./src/test/resources/dummy-non-secrets/dummy-api-key.txt")), StandardCharsets.UTF_8).trim(); Credentials credentials = new Credentials(); - credentials.setApiKey("sky-ab123-abcd1234cdef1234abcd4321cdef4321"); + credentials.setApiKey(dummyApiKey); vaultConfig.setCredentials(credentials); vaultClient = new VaultClient(vaultConfig, credentials); vaultClient.setBearerToken(); diff --git a/skyvault/src/test/resources/dummy-non-secrets/dummy-api-key.txt b/skyvault/src/test/resources/dummy-non-secrets/dummy-api-key.txt new file mode 100644 index 00000000..6f45c7d3 --- /dev/null +++ b/skyvault/src/test/resources/dummy-non-secrets/dummy-api-key.txt @@ -0,0 +1 @@ +sky-ab123-abcd1234cdef1234abcd4321cdef4321