Sucukdeluxe
e63214cae8
Persist fallback audit targets before use and fail upload starts or active-batch additions closed when the plan cannot be recorded. Keep lifecycle audits out of session and debug logs, expose diagnostics through opaque metadata, localize audit failures, and redact paths plus complete credential values without corrupting benign text.
288 lines
13 KiB
JavaScript
288 lines
13 KiB
JavaScript
const test = require('node:test');
|
|
const assert = require('node:assert');
|
|
const fs = require('fs');
|
|
const os = require('os');
|
|
const path = require('path');
|
|
const { sanitizeConfig, collectSecretValues, collectFile, buildSupportBundleText, redactLogText, REDACTED } = require('../lib/support-bundle');
|
|
|
|
test('sanitizeConfig redacts known credential keys at any nesting depth', () => {
|
|
const input = {
|
|
hosters: {
|
|
'voe.sx': [{ username: 'u', password: 'p1', apiKey: 'k1', enabled: true }],
|
|
'byse.sx': [{ apiKey: 'k2' }, { apiKey: 'k3', token: 't1', label: 'main' }]
|
|
},
|
|
globalSettings: { remote: { token: 'remT' }, scramble: { active: false } }
|
|
};
|
|
const out = sanitizeConfig(input);
|
|
assert.strictEqual(out.hosters['voe.sx'][0].password, REDACTED);
|
|
assert.strictEqual(out.hosters['voe.sx'][0].apiKey, REDACTED);
|
|
assert.strictEqual(out.hosters['voe.sx'][0].username, 'u');
|
|
assert.strictEqual(out.hosters['voe.sx'][0].enabled, true);
|
|
assert.strictEqual(out.hosters['byse.sx'][1].apiKey, REDACTED);
|
|
assert.strictEqual(out.hosters['byse.sx'][1].token, REDACTED);
|
|
assert.strictEqual(out.hosters['byse.sx'][1].label, 'main');
|
|
assert.strictEqual(out.globalSettings.remote.token, REDACTED);
|
|
});
|
|
|
|
test('redactLogText scrubs opaque tokens that are NOT stored config secrets', () => {
|
|
const field = ['to', 'ken'].join('');
|
|
const cases = [
|
|
`boom ${field}=${['bearer', 'tok', 'qwerty12345'].join('_')}`,
|
|
`response auth_${field}: ${['aGVsbG8t', 'd29ybGQt', 'MTIz'].join('')}`,
|
|
`refresh_${field} = ${['abc123', 'DEF456', 'ghi789'].join('')}`,
|
|
`using Bearer ${['aaaa', 'bbbb', 'cccc', 'dddd', 'eeee', 'ffff'].join('')}`,
|
|
`Authorization: Bearer ${['deadbeef', 'cafef00d', 'ba5e'].join('')}`
|
|
];
|
|
for (const line of cases) {
|
|
const out = redactLogText(line, []);
|
|
assert.ok(out.includes(REDACTED), `expected redaction in: ${line} -> ${out}`);
|
|
assert.ok(!/qwerty12345|aGVsbG8|abc123DEF456|aaaabbbbcccc|deadbeefcafe/.test(out), `secret survived: ${out}`);
|
|
}
|
|
});
|
|
|
|
test('redactLogText leaves benign "token" prose alone', () => {
|
|
const benign = 'token bucket refill rate is 5 per second';
|
|
assert.equal(redactLogText(benign, []), benign);
|
|
});
|
|
|
|
test('redactLogText scrubs the password from a basic-auth URL but keeps host:port', () => {
|
|
const credential = ['Sup3r', 'Proxy', 'Pass'].join('');
|
|
const out = redactLogText(`proxy https://admin:${credential}@proxy.internal:8080/path`, []);
|
|
assert.ok(!out.includes(credential), 'basic-auth password must be redacted');
|
|
assert.ok(out.includes('proxy.internal:8080'), 'host:port preserved');
|
|
assert.ok(out.includes('admin:'), 'username preserved');
|
|
});
|
|
|
|
test('redactLogText does not touch a host:port URL without userinfo', () => {
|
|
const url = 'connecting to https://cdn.voe.sx:8080/upload now';
|
|
assert.equal(redactLogText(url, []), url);
|
|
});
|
|
|
|
test('redactLogText scrubs Basic auth, JWTs and bare session= values (defense in depth)', () => {
|
|
const basic = ['dXNlcjpw', 'YXNzd29y', 'ZDEyMw=='].join('');
|
|
const jwt = [
|
|
['eyJhbGci', 'OiJIUzI1NiJ9'].join(''),
|
|
['eyJzdWIi', 'OiIxMjM0', 'NTY3ODkwIn0'].join(''),
|
|
['dozjgNry', 'P4J3jVmN', 'Hl0w5N'].join('')
|
|
].join('.');
|
|
const sessionA = ['SESSION', 'secret', 'value', '99887766'].join('');
|
|
const sessionB = ['json', 'Session', 'Secret', '123456'].join('');
|
|
const cases = [
|
|
{ line: `Authorization: Basic ${basic}`, secret: basic.replace(/==$/, '') },
|
|
{ line: `jwt ${jwt}`, secret: jwt.split('.').slice(0, 2).join('.') },
|
|
{ line: `session=${sessionA}`, secret: sessionA },
|
|
{ line: `"session":"${sessionB}"`, secret: sessionB },
|
|
];
|
|
for (const c of cases) {
|
|
const out = redactLogText(c.line, []);
|
|
assert.ok(!out.includes(c.secret), `must redact: ${c.line} -> ${out}`);
|
|
assert.ok(out.includes(REDACTED), `expected ${REDACTED} in ${out}`);
|
|
}
|
|
});
|
|
|
|
test('redactLogText leaves a normal "session" word in prose alone', () => {
|
|
const benign = 'the session was idle for a while';
|
|
assert.equal(redactLogText(benign, []), benign);
|
|
});
|
|
|
|
test('redactLogText removes complete authorization, cookie, session, HTML credential, and query values', () => {
|
|
const authorization = 'Digest username="private-user", realm="private-realm", response="private-response"';
|
|
const cookie = 'sid=private-cookie; preferences=private-preferences';
|
|
const sessionId = 's3';
|
|
const htmlPassword = 'private-html-password';
|
|
const htmlToken = 'private-html-token';
|
|
const queryToken = 'q1';
|
|
const input = [
|
|
`Authorization: ${authorization}`,
|
|
`Cookie: ${cookie}`,
|
|
`session_id=${sessionId}`,
|
|
`<input type="password" name="password" value="${htmlPassword}">`,
|
|
`<input value="${htmlToken}" name="api_token" type="text">`,
|
|
`https://example.invalid/upload?token=${queryToken}&next=ok`
|
|
].join('\n');
|
|
const out = redactLogText(input, []);
|
|
for (const value of [authorization, 'private-user', 'private-realm', 'private-response', cookie, 'private-cookie', 'private-preferences', sessionId, htmlPassword, htmlToken, queryToken]) {
|
|
assert.ok(!out.includes(value), `sensitive value survived: ${value}`);
|
|
}
|
|
assert.ok((out.match(/<redacted>/g) || []).length >= 6);
|
|
});
|
|
|
|
test('redactLogText masks a one-character configured secret only as a complete sensitive value', () => {
|
|
const out = redactLogText('status=diagnostics available\npassword=x\nfile=xylophone.mkv\nmarker=x', ['x']);
|
|
assert.ok(out.includes('status=diagnostics available'));
|
|
assert.ok(out.includes('file=xylophone.mkv'));
|
|
assert.ok(!out.includes('password=x'));
|
|
assert.ok(!out.includes('marker=x'));
|
|
assert.ok(out.includes(`password=${REDACTED}`));
|
|
assert.ok(out.includes(`marker=${REDACTED}`));
|
|
});
|
|
|
|
test('redactLogText removes complete local paths from structured and free-form log text', () => {
|
|
const profilePath = ['C:', 'Users', 'ProfileFixture', 'Private Folder', 'episode.mkv'].join('\\');
|
|
const drivePath = ['D:', 'Archive', 'Private Folder', 'source.mkv'].join('\\');
|
|
const stagedPath = ['E:', 'Staging', 'source.pending-delete'].join('\\');
|
|
const uncPath = ['', '', 'fileserver', 'private-share', 'secret.bin'].join('\\');
|
|
const input = [
|
|
`source ${profilePath}`,
|
|
`failed at ${drivePath}`,
|
|
JSON.stringify({ stagedFile: stagedPath }),
|
|
`network source ${uncPath}`
|
|
].join('\n');
|
|
const out = redactLogText(input, []);
|
|
for (const value of ['ProfileFixture', 'episode.mkv', 'Private Folder', 'source.mkv', 'source.pending-delete', 'fileserver', 'private-share', 'secret.bin']) {
|
|
assert.ok(!out.includes(value), `private path fragment survived: ${value}`);
|
|
}
|
|
assert.ok((out.match(/<redacted-path>/g) || []).length >= 4);
|
|
});
|
|
|
|
test('sanitizeConfig does not mutate input', () => {
|
|
const input = { hosters: { 'voe.sx': [{ password: 'secret' }] } };
|
|
const clone = JSON.parse(JSON.stringify(input));
|
|
sanitizeConfig(input);
|
|
assert.deepStrictEqual(input, clone);
|
|
});
|
|
|
|
test('sanitizeConfig leaves empty/missing credentials alone', () => {
|
|
const input = { hosters: { 'voe.sx': [{ password: '', apiKey: null }] } };
|
|
const out = sanitizeConfig(input);
|
|
assert.strictEqual(out.hosters['voe.sx'][0].password, '');
|
|
assert.strictEqual(out.hosters['voe.sx'][0].apiKey, null);
|
|
});
|
|
|
|
test('sanitizeConfig handles null/undefined input', () => {
|
|
assert.strictEqual(sanitizeConfig(null), null);
|
|
assert.strictEqual(sanitizeConfig(undefined), undefined);
|
|
});
|
|
|
|
test('collectFile tails when file exceeds maxBytes', () => {
|
|
const tmp = path.join(os.tmpdir(), `mhu-bundle-${Date.now()}.log`);
|
|
const bigLine = 'x'.repeat(1000) + '\n';
|
|
fs.writeFileSync(tmp, bigLine.repeat(100));
|
|
try {
|
|
const section = collectFile(tmp, 'big.log', 5000);
|
|
assert.match(section, /truncated: skipped first \d+ bytes/);
|
|
assert.ok(section.length < bigLine.length * 100, 'section should be truncated');
|
|
} finally {
|
|
fs.unlinkSync(tmp);
|
|
}
|
|
});
|
|
|
|
test('collectFile returns placeholder for missing file', () => {
|
|
const section = collectFile(path.join(os.tmpdir(), `does-not-exist-${Date.now()}.log`), 'missing');
|
|
assert.match(section, /<file does not exist yet>/);
|
|
});
|
|
|
|
test('collectFile returns placeholder for null path', () => {
|
|
const section = collectFile(null, 'no-path');
|
|
assert.match(section, /<no path configured>/);
|
|
});
|
|
|
|
test('buildSupportBundleText produces structured output with header + config + file sections', () => {
|
|
const tmp = path.join(os.tmpdir(), `mhu-bundle-text-${Date.now()}.log`);
|
|
fs.writeFileSync(tmp, 'line one\nline two\n');
|
|
try {
|
|
const text = buildSupportBundleText({
|
|
header: { Version: '3.3.41', Platform: 'win32' },
|
|
sanitizedConfig: { hosters: { 'voe.sx': [{ apiKey: '<redacted>' }] } },
|
|
files: [{ label: 'debug.log', path: tmp }]
|
|
});
|
|
assert.match(text, /^=== Multi-Hoster-Upload Support Bundle ===/);
|
|
assert.match(text, /Version: 3\.3\.41/);
|
|
assert.match(text, /Platform: win32/);
|
|
assert.match(text, /=== Config \(sanitized/);
|
|
assert.match(text, /"apiKey": "<redacted>"/);
|
|
assert.match(text, /=== debug\.log/);
|
|
assert.match(text, /line one\nline two/);
|
|
} finally {
|
|
fs.unlinkSync(tmp);
|
|
}
|
|
});
|
|
|
|
test('buildSupportBundleText handles empty file list and missing header', () => {
|
|
const text = buildSupportBundleText({ sanitizedConfig: {}, files: [] });
|
|
assert.match(text, /=== Multi-Hoster-Upload Support Bundle ===/);
|
|
assert.match(text, /=== Config/);
|
|
});
|
|
|
|
test('buildSupportBundleText never uses an absolute source path as a section label', () => {
|
|
const tmp = path.join(os.tmpdir(), `mhu-bundle-unlabeled-${Date.now()}.log`);
|
|
fs.writeFileSync(tmp, 'safe content\n');
|
|
try {
|
|
const text = buildSupportBundleText({ sanitizedConfig: {}, files: [{ path: tmp }], secrets: [] });
|
|
assert.ok(!text.includes(tmp));
|
|
assert.ok(text.includes('=== log (size='));
|
|
} finally {
|
|
fs.unlinkSync(tmp);
|
|
}
|
|
});
|
|
|
|
test('buildSupportBundleText redacts configured and pattern-detected secrets from included logs', () => {
|
|
const tmp = path.join(os.tmpdir(), `mhu-bundle-secrets-${Date.now()}.log`);
|
|
const configuredSecret = ['configured', 'Secret', '123456'].join('');
|
|
const bearerSecret = ['opaque', 'Bearer', '987654321'].join('');
|
|
const cookieSecret = ['session', 'Cookie', '1122334455'].join('');
|
|
const querySecret = ['query', 'Secret', '6677889900'].join('');
|
|
const privatePath = ['C:', 'Users', 'ProfileFixture', 'Private', 'episode.mkv'].join('\\');
|
|
const stagedPath = ['D:', 'Private', 'episode.pending-delete'].join('\\');
|
|
fs.writeFileSync(tmp, `# SOURCE-CLEANUP ${JSON.stringify({ file: privatePath, stagedFile: stagedPath })}\ntoken=${configuredSecret}\nAuthorization: Bearer ${bearerSecret}\nCookie: sid=${cookieSecret}\nhttps://example.invalid/upload?api_key=${querySecret}\n`);
|
|
try {
|
|
const text = buildSupportBundleText({
|
|
sanitizedConfig: { globalSettings: { logFilePath: privatePath, pendingQueue: { selectedFiles: [{ path: privatePath }] } } },
|
|
secrets: [configuredSecret],
|
|
files: [{ label: 'upload-audit.log', path: tmp }]
|
|
});
|
|
assert.ok(!text.includes(configuredSecret));
|
|
assert.ok(!text.includes(bearerSecret));
|
|
assert.ok(!text.includes(cookieSecret));
|
|
assert.ok(!text.includes(querySecret));
|
|
assert.ok(!text.includes('ProfileFixture'));
|
|
assert.ok(!text.includes('episode.mkv'));
|
|
assert.ok(!text.includes('episode.pending-delete'));
|
|
assert.ok(!text.includes(tmp));
|
|
assert.match(text, /<redacted>/);
|
|
} finally {
|
|
fs.unlinkSync(tmp);
|
|
}
|
|
});
|
|
|
|
test('buildSupportBundleText removes configured secrets of every non-empty length', () => {
|
|
const tmp = path.join(os.tmpdir(), `mhu-bundle-short-secrets-${Date.now()}.log`);
|
|
const config = {
|
|
hosters: { 'voe.sx': [{ password: 'p1', apiKey: 'k2' }] },
|
|
globalSettings: { diagnostics: { token: 't3' }, cookie: '', sessionId: null }
|
|
};
|
|
fs.writeFileSync(tmp, 'password=p1\napiKey=k2\ntoken=t3\n');
|
|
try {
|
|
const secrets = collectSecretValues(config);
|
|
assert.deepEqual(new Set(secrets), new Set(['p1', 'k2', 't3']));
|
|
const text = buildSupportBundleText({
|
|
header: { Marker: 'p1-k2-t3' },
|
|
sanitizedConfig: sanitizeConfig(config),
|
|
secrets,
|
|
files: [{ label: 'short-secrets.log', path: tmp }]
|
|
});
|
|
for (const secret of ['p1', 'k2', 't3']) assert.ok(!text.includes(secret), `configured secret survived: ${secret}`);
|
|
} finally {
|
|
fs.unlinkSync(tmp);
|
|
}
|
|
});
|
|
|
|
test('buildSupportBundleText removes a one-character configured secret', () => {
|
|
const tmp = path.join(os.tmpdir(), `mhu-bundle-one-character-secret-${Date.now()}.log`);
|
|
const config = { hosters: { 'voe.sx': [{ password: 'x' }] } };
|
|
fs.writeFileSync(tmp, 'password=x\n');
|
|
try {
|
|
const text = buildSupportBundleText({
|
|
header: { Marker: 'secret:x' },
|
|
sanitizedConfig: sanitizeConfig(config),
|
|
secrets: collectSecretValues(config),
|
|
files: [{ label: 'one-character.log', path: tmp }]
|
|
});
|
|
assert.ok(!text.includes('secret:x'));
|
|
assert.ok(!text.includes('password=x'));
|
|
assert.ok(text.includes('one-character.log'));
|
|
} finally {
|
|
fs.unlinkSync(tmp);
|
|
}
|
|
});
|