kw/nolimit-discounts
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Assemble the self-test's fixture values instead of writing them literally

Browse Source 
CI caught this on the previous commit's first push: the credential scan flagged
ci/selftest.sh itself, twice. The file is tracked, the scan reads every tracked
file, and the fixtures were credential-shaped literals sitting in it.

It passed locally because I ran ci/static.sh before `git add`, so selftest.sh
was still UNTRACKED and therefore invisible to a scan reading git ls-files.
That trap is documented four lines into the same file, about the fixtures it
plants. Knowing it and applying it to your own validation are two different
things, and the second is the one that counts.

Fixed by assembling every fixture value from pieces, which is stronger than any
exemption:

  - A filename exemption would switch the scan off in ci/ and tests/, which is
    exactly where a key gets pasted to test it. A sibling plugin reached the
    same conclusion from the other side when its redactor fixture went red.
  - A placeholder marker in the value would stop the fixture triggering the
    check it exists to trigger.
  - Split literals leave the WRITTEN file fully credential-shaped while the
    SOURCE contains no matching string at all, so nothing needs excusing.

Verified both directions: the source no longer matches any pattern in the scan,
and each assembled value still does. static.sh green on the real tree with
selftest.sh tracked (45 files read, up from 44), self-test 26/26.

The pipeline worked as designed — static.sh runs before selftest.sh in the
static job, so the real tree was checked first and the failure named the file
and both rules. Nothing about this needed a human to notice.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kristianwind
2026-09-17 00:33:14 +02:00
co-authored by Claude Opus 5
parent 0a58661864
commit d0dcbd2c55
1 changed files with 36 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ci/selftest.sh
+36 -13
View File
@@ -44,31 +44,54 @@ cd "$work/repo"
# stay quiet. An unfilled placeholder is not optional decoration: it is the one
# string a settings screen is guaranteed to contain, so a rule without that
# exclusion cries wolf on day one and gets commented out.
printf 'aws = AKIAIOSFODNN7EXAMPLE\n' > probe-aws.txt
printf -- '-----BEGIN RSA PRIVATE KEY-----\nMIIEfake\n' > probe-pem.txt
printf 'k = sk-ant-api03-AAAAAAAAAAAAAAAAAAAA\n' > probe-skant.txt
printf 'k = ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n' > probe-ghp.txt
printf 'k = gho_BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB\n' > probe-gho.txt
printf 'k = github_pat_%s\n' "$(printf 'C%.0s' $(seq 1 60))" > probe-pat.txt
printf 'k = sk-DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD\n' > probe-sk.txt
printf "'api_key' => 'h8Kd92MsLp01QwErTyUiOp',\n" > probe-array.txt
printf "define( 'WC_EDM_SECRET', 'h8Kd92MsLp01QwErTyUi' );\n" > probe-define.txt
# 🔴 Every fixture value below is ASSEMBLED from pieces, never written as a
# literal. This script is itself a tracked file, so ci/static.sh scans it — and
# a credential-shaped literal here makes the real tree go red. It did: CI
# flagged ci/selftest.sh on this file's first push.
#
# Assembling is better than any exemption. A filename exemption would switch
# the scan off in ci/ and tests/, which is exactly where a key gets pasted to
# test it. A placeholder marker in the value would stop the fixture triggering
# the check it exists to trigger. Split literals leave the written file fully
# credential-shaped while the source contains no matching string at all, so
# nothing has to be excused.
akia="AKIA""IOSFODNN7EXAMPLE"
pem="-----BEGIN RSA PRIVATE"" KEY-----"; pem="${pem/ / }"
skant="sk-ant-""api03-AAAAAAAAAAAAAAAAAAAA"
ghp="ghp_""AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
gho="gho_""BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
pat="github_pat_""$(printf 'C%.0s' $(seq 1 60))"
sk="sk-""DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
opaque="h8Kd92MsLp01QwErTyUiOp"
printf 'aws = %s\n' "$akia" > probe-aws.txt
printf -- '%s\nMIIEfake\n' "$pem" > probe-pem.txt
printf 'k = %s\n' "$skant" > probe-skant.txt
printf 'k = %s\n' "$ghp" > probe-ghp.txt
printf 'k = %s\n' "$gho" > probe-gho.txt
printf 'k = %s\n' "$pat" > probe-pat.txt
printf 'k = %s\n' "$sk" > probe-sk.txt
printf "'api_key' => '%s',\n" "$opaque" > probe-array.txt
printf "define( 'WC_EDM_SECRET', '%s' );\n" "$opaque" > probe-define.txt
# Directory coverage. .distignore removes all three from the zip, and a scan
# reading the SHIPPED list instead of the tracked one therefore misses every CI
# script, workflow and test fixture — which is exactly where a key gets pasted
# to test it. A sibling plugin was missing 36 of 73 files this way.
mkdir -p ci tests .github/workflows
printf 'k = sk-ant-api03-AAAAAAAAAAAAAAAAAAAA\n' > ci/probe-dir.txt
printf 'k = sk-ant-api03-AAAAAAAAAAAAAAAAAAAA\n' > tests/probe-dir.txt
printf 'k = sk-ant-api03-AAAAAAAAAAAAAAAAAAAA\n' > .github/workflows/probe-dir.txt
printf 'k = %s\n' "$skant" > ci/probe-dir.txt
printf 'k = %s\n' "$skant" > tests/probe-dir.txt
printf 'k = %s\n' "$skant" > .github/workflows/probe-dir.txt
# A key inside a file grep calls binary. `grep -I` skips these SILENTLY, so the
# value rule must not use it; the build going red is the right direction to be
# wrong in. This fixture exists because that flag was added by accident and
# nothing went red to announce it.
printf 'PNG\x00\x00\x00fake-----BEGIN RSA PRIVATE KEY-----\nMIIE\n' > probe-binary.bin
printf 'PNG\x00\x00\x00fake%s\nMIIE\n' "$pem" > probe-binary.bin
# Controls need no assembling: each is either a placeholder the scan excludes
# by design, or ordinary code that was never credential-shaped. If one of these
# ever makes the real tree go red, that is a false positive worth knowing about.
printf 'sha = 9f2b7c1e4a8d6b3f0e5c2a9d7b4f1e8c\nAKIA\n' > control-hash.txt
printf "'api_key' => 'REPLACE_WITH_YOUR_API_KEY',\n" > control-placeholder.txt
printf "'password' => 'xxxxxxxxxxxxxxxxxxxxxxxx',\n" > control-masked.txt