Merge pull request 'fix(security) : ignorer les placeholders URL documentaires' (#36) from fix/issue-34-secret-placeholder into main

2026-09-12 23:58:01 +02:00
parent c0a1c5ca62 c47325ef14
commit 50c3696b06
3 changed files with 90 additions and 1 deletions
@@ -118,6 +118,75 @@ def test_main_detects_sensitive_url_parameter(
    assert sentinel not in output


+def test_main_ignores_documentation_url_placeholders(
+    secret_checker: ModuleType, tmp_path: Path, capsys: CaptureFixture[str]
+) -> None:
+    """Ignore les marqueurs de remplacement utilisés dans une documentation.
+
+    :param secret_checker: Module du script sous test.
+    :param tmp_path: Répertoire temporaire représentant un dépôt.
+    :param capsys: Fixture de capture de sortie.
+    :return: None
+    """
+    (tmp_path / "guide.md").write_text(
+        "\n".join(
+            (
+                "https://example.invalid/?icalsecurise={jeton}",
+                "https://example.invalid/?icalsecurise=••••••••",
+                "https://example.invalid/?icalsecurise=<token>",
+                "https://example.invalid/?icalsecurise=...",
+            )
+        )
+        + "\n",
+        encoding="utf-8",
+    )
+
+    assert secret_checker.main([], root=tmp_path) == 0
+    assert "OK:" in capsys.readouterr().out
+
+
+def test_main_detects_a_real_url_secret_after_a_placeholder(
+    secret_checker: ModuleType, tmp_path: Path, capsys: CaptureFixture[str]
+) -> None:
+    """Détecte un secret réel placé après un placeholder sur la même URL.
+
+    :param secret_checker: Module du script sous test.
+    :param tmp_path: Répertoire temporaire représentant un dépôt.
+    :param capsys: Fixture de capture de sortie.
+    :return: None
+    """
+    sentinel = "m14-url-after-placeholder-sentinel"
+    (tmp_path / "guide.md").write_text(
+        f"https://example.invalid/?token={{jeton}}&api_key={sentinel}\n",
+        encoding="utf-8",
+    )
+
+    assert secret_checker.main([], root=tmp_path) == 1
+    output = capsys.readouterr().out
+    assert "guide.md:1 (parametre-url)" in output
+    assert sentinel not in output
+
+
+@pytest.mark.parametrize("value", ["<ghp_…>", "***"])
+def test_main_rejects_ambiguous_url_placeholders(
+    secret_checker: ModuleType, tmp_path: Path, capsys: CaptureFixture[str], value: str
+) -> None:
+    """Refuse les valeurs qui ne sont pas des placeholders documentaires fermés.
+
+    :param secret_checker: Module du script sous test.
+    :param tmp_path: Répertoire temporaire représentant un dépôt.
+    :param capsys: Fixture de capture de sortie.
+    :param value: Valeur ambiguë à ne pas exempter.
+    :return: None
+    """
+    (tmp_path / "guide.md").write_text(
+        f"https://example.invalid/?token={value}\n", encoding="utf-8"
+    )
+
+    assert secret_checker.main([], root=tmp_path) == 1
+    assert "guide.md:1 (parametre-url)" in capsys.readouterr().out
+
+
 def test_staged_mode_inspects_only_paths_provided_by_git(
    secret_checker: ModuleType, tmp_path: Path, capsys: CaptureFixture[str]
 ) -> None: