From bb28c9976782df2ae5ec9d1a8e7e54dd81d30c22 Mon Sep 17 00:00:00 2001 From: x Date: Mon, 5 Oct 2026 11:28:32 -0400 Subject: [PATCH 1/2] test(agent): collect tests/verify_*.py so CI runs the VULN regression suite pyproject restricted python_files to test_*.py, so the 11 verify_NNN_*.py security regression files (51 tests) were never collected by bare pytest or CI. Add verify_*.py to python_files. While enabling them, two verify_012 cases were found to be vacuous: the bearer-header and access_token-query tests used ghp_-prefixed tokens, which the raw-prefix pass masks regardless, so disabling either pass left them green. Switch them to opaque tokens so each exercises its own pass, and drop an unused pytest import. Closes #38 Co-Authored-By: Claude Opus 5.5 --- vulnhunter-agent/pyproject.toml | 2 +- vulnhunter-agent/tests/verify_012_audit_redaction.py | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/vulnhunter-agent/pyproject.toml b/vulnhunter-agent/pyproject.toml index 773eeab..ba5868f 100644 --- a/vulnhunter-agent/pyproject.toml +++ b/vulnhunter-agent/pyproject.toml @@ -32,7 +32,7 @@ version = { attr = "vulnhunter.__version__" } [tool.pytest.ini_options] testpaths = ["tests"] -python_files = ["test_*.py"] +python_files = ["test_*.py", "verify_*.py"] asyncio_mode = "auto" filterwarnings = [ "error", diff --git a/vulnhunter-agent/tests/verify_012_audit_redaction.py b/vulnhunter-agent/tests/verify_012_audit_redaction.py index 759164e..6fb7a31 100644 --- a/vulnhunter-agent/tests/verify_012_audit_redaction.py +++ b/vulnhunter-agent/tests/verify_012_audit_redaction.py @@ -5,8 +5,6 @@ headers, access_token query params, and raw token prefixes. """ -import pytest - from agent._url import redact @@ -16,14 +14,16 @@ def test_basic_auth_still_redacted(): ) +# The bearer and query-param cases use opaque tokens with no known prefix, so +# the raw-prefix pass can't mask them and each test exercises only its own pass. def test_bearer_header_redacted(): - out = redact("Authorization: Bearer ghp_AAAA1111BBBB2222CCCC3333") + out = redact("Authorization: Bearer AAAA1111BBBB2222CCCC3333") assert "AAAA1111BBBB2222" not in out assert "***" in out def test_access_token_query_redacted(): - out = redact("https://api.github.com/x?access_token=ghp_SECRET1234ABCD&y=1") + out = redact("https://api.github.com/x?access_token=SECRET1234ABCD&y=1") assert "SECRET1234ABCD" not in out assert "y=1" in out # non-secret query params preserved From a2ad91f6136c3502550453ae220f029c2e23304b Mon Sep 17 00:00:00 2001 From: Scott Schenkein Date: Mon, 5 Oct 2026 11:44:42 -0400 Subject: [PATCH 2/2] test(agent): restore process umask after verify_013 tests verify_013 forces os.umask(0o022) and never restored it. Harmless while the file was uncollected; now that CI runs verify_*.py, the changed umask leaked into every later test in the process. Save and restore it with an autouse fixture. Co-Authored-By: Claude Opus 5.5 --- vulnhunter-agent/tests/verify_013_audit_umask.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/vulnhunter-agent/tests/verify_013_audit_umask.py b/vulnhunter-agent/tests/verify_013_audit_umask.py index f2f3297..7888b8a 100644 --- a/vulnhunter-agent/tests/verify_013_audit_umask.py +++ b/vulnhunter-agent/tests/verify_013_audit_umask.py @@ -8,9 +8,21 @@ import os import stat +import pytest + from agent.audit import _open_append +@pytest.fixture(autouse=True) +def _restore_umask(): + # The tests below force umask 022; restore the caller's umask so it doesn't + # leak into whatever test runs next in the same process. + old = os.umask(0o022) + os.umask(old) + yield + os.umask(old) + + def test_audit_file_is_owner_only(tmp_path): os.umask(0o022) # the umask that would otherwise leak 0o644 path = tmp_path / "sub" / "audit_events.jsonl"