[WorkItem(126)] // Exclude secrets from log data: http://jira.sonarsource.com/browse/SONARMSBRU-126
public void ProcRunner_DoNotLogSensitiveData()
{
// Arrange
var testDir = TestUtils.CreateTestSpecificFolder(TestContext);
// Create a dummy exe that will produce a log file showing any input args
var exeName = DummyExeHelper.CreateDummyPostProcessor(testDir, 0);
var logger = new TestLogger();
// Public args - should appear in the log
var publicArgs = new string[]
{
"public1",
"public2",
"/d:sonar.projectKey=my.key"
};
var sensitiveArgs = new string[] {
// Public args - should appear in the log
"public1", "public2", "/dmy.key=value",
// Sensitive args - should not appear in the log
"/d:sonar.password=secret data password",
"/d:sonar.login=secret data login",
"/d:sonar.jdbc.password=secret data db password",
"/d:sonar.jdbc.username=secret data db user name",
// Sensitive args - different cases -> exclude to be on the safe side
"/d:SONAR.jdbc.password=secret data db password upper",
"/d:sonar.PASSWORD=secret data password upper",
// Sensitive args - parameter format is slightly incorrect -> exclude to be on the safe side
"/dsonar.login =secret data key typo",
"sonar.password=secret data password typo"
};
var allArgs = sensitiveArgs.Union(publicArgs).ToArray();
var runnerArgs = new ProcessRunnerArguments(exeName, false, logger)
{
CmdLineArgs = allArgs
};
var runner = new ProcessRunner();
// Act
var success = runner.Execute(runnerArgs);
// Assert
Assert.IsTrue(success, "Expecting the process to have succeeded");
Assert.AreEqual(0, runner.ExitCode, "Unexpected exit code");
// Check public arguments are logged but private ones are not
foreach (var arg in publicArgs)
{
logger.AssertSingleDebugMessageExists(arg);
}
logger.AssertSingleDebugMessageExists(SonarQube.Common.Resources.MSG_CmdLine_SensitiveCmdLineArgsAlternativeText);
AssertTextDoesNotAppearInLog("secret", logger);
// Check that the public and private arguments are passed to the child process
var exeLogFile = DummyExeHelper.AssertDummyPostProcLogExists(testDir, TestContext);
DummyExeHelper.AssertExpectedLogContents(exeLogFile, allArgs);
}
public void Exe__Version0_9Compatibility()
{
// Tests compatibility with the bootstrapper API used in v0.9
// The pre-processor should be called if any arguments are passed.
// The post-processor should be called if no arguments are passed.
// Default settings:
// There must be a default settings file next to the bootstrapper exe to supply
// the necessary settings, and the bootstrapper should pass this settings path
// to the pre-processor (since the pre-process is downloaded to a different
// directory).
// Arrange
string rootDir = TestUtils.CreateTestSpecificFolder(this.TestContext);
using (InitializeNonTeamBuildEnvironment(rootDir))
{
string binDir = CalculateBinDir(rootDir);
MockBuildAgentUpdater mockUpdater = CreateValidUpdater(binDir, "http://host");
mockUpdater.Updating += (sender, args) =>
{
Assert.IsTrue(Directory.Exists(args.TargetDir), "Expecting the target directory to have been created");
DummyExeHelper.CreateDummyPreProcessor(args.TargetDir, 0 /* post-proc succeeds */);
DummyExeHelper.CreateDummyPostProcessor(args.TargetDir, 0 /* post-proc succeeds */);
};
// Create a default properties file next to the exe
AnalysisProperties defaultProperties = new AnalysisProperties();
defaultProperties.Add(new Property()
{
Id = SonarProperties.HostUrl, Value = "http://host"
});
string defaultPropertiesFilePath = CreateDefaultPropertiesFile(defaultProperties);
// Act
try
{
// Call the pre-processor
TestLogger logger = CheckExecutionSucceeds(mockUpdater, "/v:version", "/n:name", "/k:key");
logger.AssertWarningsLogged(1); // Should be warned once about the missing "begin" / "end"
logger.AssertSingleWarningExists(ArgumentProcessor.BeginVerb, ArgumentProcessor.EndVerb);
mockUpdater.AssertUpdateAttempted();
mockUpdater.AssertVersionChecked();
string logPath = DummyExeHelper.AssertDummyPreProcLogExists(binDir, this.TestContext);
DummyExeHelper.AssertExpectedLogContents(logPath,
"/v:version",
"/n:name",
"/k:key",
"/s:" + defaultPropertiesFilePath);
DummyExeHelper.AssertDummyPostProcLogDoesNotExist(binDir);
// Call the post-process (no arguments)
logger = CheckExecutionSucceeds(mockUpdater);
logPath = DummyExeHelper.AssertDummyPostProcLogExists(binDir, this.TestContext);
DummyExeHelper.AssertExpectedLogContents(logPath, null);
logger.AssertWarningsLogged(1); // Should be warned once about the missing "begin" / "end"
logger.AssertSingleWarningExists(ArgumentProcessor.BeginVerb, ArgumentProcessor.EndVerb);
}
finally
{
File.Delete(defaultPropertiesFilePath);
}
}
}