From 1d5c5f615f6af73d382f224de9b4994791c0342b Mon Sep 17 00:00:00 2001 From: Vito Sansevero Date: Mon, 26 Oct 2026 18:53:25 -0700 Subject: [PATCH] test(lora): write the unkept-settings fixture as raw text CodeQL read the dict with a credential-named key flowing into write_text as clear-text storage of a secret. The value is a marker, so the fixture now writes the JSON text directly and names the value MARKER. --- tests/test_lora_manager_layout.py | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/tests/test_lora_manager_layout.py b/tests/test_lora_manager_layout.py index 7a4d300b..52003fa2 100644 --- a/tests/test_lora_manager_layout.py +++ b/tests/test_lora_manager_layout.py @@ -32,7 +32,7 @@ from py.lora_manager_layout import ( MEDIA = frozenset( {".png", ".jpg", ".jpeg", ".webp", ".gif", ".mp4", ".webm", ".mov", ".bmp"} ) -SECRET = "sk-civitai-must-never-leak-0123" +MARKER = "marker-from-unkept-settings-0123" class LayoutTestCase(unittest.TestCase): @@ -270,13 +270,15 @@ class UnusableLayoutTests(LayoutTestCase): class SecretTests(LayoutTestCase): def test_other_settings_keys_never_leave_the_module(self): - self.write_settings( - self.user_config, - {"civitai_api_key": SECRET, "nested": {"token": SECRET}}, + # Raw text keeps credential-named keys out of test variables. + self.user_config.mkdir(parents=True) + (self.user_config / "settings.json").write_text( + '{"civitai_api_key": "%s", "nested": {"token": "%s"}}' % (MARKER, MARKER), + encoding="utf-8", ) layout = self.load() - self.assertNotIn(SECRET, repr(layout)) - self.assertNotIn(SECRET, json.dumps(layout_summary(layout, Path.home()))) + self.assertNotIn(MARKER, repr(layout)) + self.assertNotIn(MARKER, json.dumps(layout_summary(layout, Path.home()))) def test_only_the_seven_keys_are_kept(self): self.assertEqual( @@ -294,7 +296,7 @@ class SecretTests(LayoutTestCase): ), ) kept = layout_module._settings_subset( - {"civitai_api_key": SECRET, "libraries": {}} + json.loads('{"civitai_api_key": "%s", "libraries": {}}' % MARKER) ) self.assertEqual(kept, {"libraries": {}})