pg-proto 0.2.1

Session-typed PostgreSQL wire protocol
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

//! Regression tests for redaction of authentication and cancellation secrets.

use bytes::Bytes;
use pg_proto::{
    codec::FrontendMessage, demux::CancelKey, integrations::TokenStep,
    server_auth::SaslInitialResponse,
};

#[test]
fn authentication_secrets_are_redacted_from_debug_output() {
    let password = format!(
        "{:?}",
        FrontendMessage::PasswordResponse(Bytes::from_static(b"highly-secret-password"))
    );
    let cancellation = format!(
        "{:?}",
        CancelKey {
            process_id: 42,
            secret_key: Bytes::from_static(b"cancel-secret"),
        }
    );
    let sasl = format!(
        "{:?}",
        SaslInitialResponse {
            mechanism: Bytes::from_static(b"SCRAM-SHA-256"),
            response: Some(Bytes::from_static(b"client-proof")),
        }
    );
    let token = format!(
        "{:?}",
        TokenStep::Continue(Bytes::from_static(b"platform-token"))
    );

    for (rendered, secret) in [
        (password, "highly-secret-password"),
        (cancellation, "cancel-secret"),
        (sasl, "client-proof"),
        (token, "platform-token"),
    ] {
        assert!(!rendered.contains(secret));
        assert!(rendered.contains("REDACTED") || rendered.contains("Some("));
    }
}