AaronFiore/electrum
1
0
Fork 0
Code Activity

jsonpatch exception-mangling: more robust against secrets in dict keys

Browse Source
This commit is contained in:
SomberNight
2025-07-14 12:48:28 +00:00
parent 195d89a509
commit b16760b861
3 changed files with 35 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
tests/test_jsondb.py
View File

@@ -39,14 +39,12 @@ class TestJsonpatch(ElectrumTestCase):
def fail_if_leaking_secret(ctx) -> None:
self.assertNotIn("secret", str(ctx.exception))
self.assertNotIn("secret", repr(ctx.exception))
self.assertNotIn("secret", ctx._customctx_original_tb)
self.assertNotIn("dictlevel", str(ctx.exception))
self.assertNotIn("dictlevel", repr(ctx.exception))
self.assertNotIn("dictlevel", ctx._customctx_original_tb)
self.assertIn("redacted", str(ctx.exception)) # injected by our monkeypatching
self.assertIn("redacted", repr(ctx.exception)) # injected by our monkeypatching
self.assertNotIn("secret", ctx._customctx_original_tb)
# Note, crucially, the following assert would FAIL:
# That is, exceptions might "leak" the db *path* but not values stored at the innermost level.
# IOW, in case of dicts, secrets should be stored in values. Dict keys should never contain secrets,
# as dict keys can appear in tracebacks.
#self.assertNotIn("dictlevel", ctx._customctx_original_tb)
# op "replace"
with self.subTest(msg="replace_dict_inner_key_missing"):
patches = [{"op": "replace", "path": "/dictlevelA1/dictlevelX2", "value": "nakamoto_secret"}]