32 lines
931 B
Go
32 lines
931 B
Go
package guardrail
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestSanitizeTextMasksCommonSecrets(t *testing.T) {
|
|
input := "Authorization: Bearer abcdefghijklmnopqrstuvwxyz password=secret123 mysql://root:pass@db/prod"
|
|
got := SanitizeText(input)
|
|
for _, leak := range []string{"abcdefghijklmnopqrstuvwxyz", "secret123", "root:pass@db"} {
|
|
if strings.Contains(got, leak) {
|
|
t.Fatalf("敏感信息未脱敏: %s in %s", leak, got)
|
|
}
|
|
}
|
|
if !strings.Contains(got, "[REDACTED]") {
|
|
t.Fatalf("脱敏标记缺失: %s", got)
|
|
}
|
|
}
|
|
|
|
func TestSanitizeJSONMasksSensitiveKeys(t *testing.T) {
|
|
got := SanitizeJSON(`{"command":"echo ok","password":"p1","nested":{"api_key":"k1"}}`)
|
|
for _, leak := range []string{"p1", "k1"} {
|
|
if strings.Contains(got, leak) {
|
|
t.Fatalf("JSON 敏感字段未脱敏: %s in %s", leak, got)
|
|
}
|
|
}
|
|
if !strings.Contains(got, `"command":"echo ok"`) {
|
|
t.Fatalf("非敏感字段不应被改写: %s", got)
|
|
}
|
|
}
|