curo1305
251e509ee0
Unit tests: - test_security_boundaries.py: vault block, vault lock sentinel - test_security_injection.py: all 4 injection categories, case-insensitive - test_vault_rw.py: roundtrip, file permissions (chmod 400), no key in config - test_config.py: schema roundtrip, no api_key field, chmod 600 on config.yaml - test_memory_reader.py: list, read, sandboxing, context loading - test_memory_writer.py: write, append, index update, traversal blocked, chmod 600 - test_providers.py: required fields, unique IDs, litellm prefix format - test_renderer.py: key redaction for sk-ant-, sk-, AIza patterns Security tests: - test_vault_ai_isolation.py: 7 traversal patterns blocked via memory read/write - test_path_traversal.py: 20+ traversal patterns — all rejected for read and write - test_prompt_injection.py: 21-item corpus + 5 clean texts (no false positives) Integration tests: - test_lmstudio.py: live call to localhost:1234, streaming, full stack session, injection scan on real output (skips if LM Studio not running) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
37 lines
923 B
Python
37 lines
923 B
Python
from pyra.security.injection import redact_api_keys
|
|
|
|
|
|
def test_anthropic_key_redacted():
|
|
text = "sk-ant-api03-abcdefghijklmnopqrstuvwxyz"
|
|
result = redact_api_keys(text)
|
|
assert "sk-ant-" not in result
|
|
assert "[REDACTED]" in result
|
|
|
|
|
|
def test_openai_key_redacted():
|
|
text = "Key is sk-abcdefghijklmnopqrstu"
|
|
result = redact_api_keys(text)
|
|
assert "[REDACTED]" in result
|
|
|
|
|
|
def test_google_key_redacted():
|
|
text = f"AIza{'B' * 35} is my key"
|
|
result = redact_api_keys(text)
|
|
assert "AIza" not in result
|
|
assert "[REDACTED]" in result
|
|
|
|
|
|
def test_clean_text_unchanged():
|
|
text = "The answer is 42. No API keys here."
|
|
result = redact_api_keys(text)
|
|
assert result == text
|
|
|
|
|
|
def test_multiple_keys_in_one_string():
|
|
text = (
|
|
f"First: sk-ant-{'x' * 20}, "
|
|
f"Second: sk-{'y' * 25}"
|
|
)
|
|
result = redact_api_keys(text)
|
|
assert result.count("[REDACTED]") >= 1
|