Repository navigation
test(anthropic-subscription): use a plainly fake OAuth token in the real-CLI capture tests - #3455
Merged
Merged
Conversation
…eal-CLI capture tests Fixes #3436. GitGuardian flagged the "sk-ant-oat01-" shaped CLAUDE_CODE_OAUTH_TOKEN fixture in the #3408 regression test as a generic high-entropy secret on a PR that merged main. The token only goes to a local 127.0.0.1 mock server and no test asserts on its value, so the 3408 and 2982 capture tests now pass "fake-oauth-token-for-local-mock-server": no real-token prefix, no entropy.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3436.
GitGuardian flagged a "Generic High Entropy Secret" on #3296 after it merged
main. The finding pointed at theCLAUDE_CODE_OAUTH_TOKENfixture in the #3408 regression test (sk-ant-oat01-…). That token only goes to a local127.0.0.1mock server, and no test asserts on its value.Change (tests only, 2 files, 3 lines): the #3408 and #2982 real-CLI capture tests now pass
fake-oauth-token-for-local-mock-server. It has no real-token prefix and nothing random-looking, so scanners have nothing to match. I swept the other subscription tests: the remainingsk-ant-oat01-test…values inpackages/aiandinteractive-mode-anthropic-warningare short literal "test" strings that were never flagged, so they're left as is.Evidence (mengmotaMac, fresh clone at the head, pinned bun 1.4.2):
bun install --frozen-lockfile: exit 0bun run check: exit 03408-subscription-requested-window+2982-anthropic-subscription-append-only-prompt-capture: 2 files, 9/9 passed, none skipped. Both spawn the installed Claude Code CLI against the mock, so this proves the CLI accepts a token without thesk-ant-oat01-prefix.Summary by cubic
Replaces the
sk-ant-oat01--shapedCLAUDE_CODE_OAUTH_TOKENfixtures in the #3408 and #2982 real-CLI capture tests withfake-oauth-token-for-local-mock-server, so GitGuardian no longer flags them as high-entropy secrets. The token only reaches a local127.0.0.1mock server and no test asserts on its value. Tests only, no product behavior changes.Written for commit 5e7bf85. Summary will update on new commits.