Skip to content
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
86 changes: 85 additions & 1 deletion src/quantum/tests.live/Run.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,87 @@ function Invoke-SASTokenObfuscation {
}
}

function Invoke-APIKeyObfuscation {
param (
[Parameter(mandatory=$true)]
$RecordingsFolderPath
)

Get-ChildItem "$RecordingsFolderPath" -Filter *.yaml |
Foreach-Object {
$RecordingFileName = $_.Name
$PathToRecording = "$RecordingsFolderPath\$RecordingFileName"
Write-Verbose -Message "Searching for API Keys in ""$PathToRecording"" and obfuscating it..."
(Get-Content $PathToRecording) -replace 'api_key=[\w%]+','api_key=REDACTED' | Set-Content $PathToRecording
}
}

function Invoke-QuantumWorkspaceDataObfuscation {
param (
[Parameter(mandatory=$true)]
$RecordingsFolderPath
)

Get-ChildItem "$RecordingsFolderPath" -Filter *.yaml |
Foreach-Object {
$RecordingFileName = $_.Name
$PathToRecording = "$RecordingsFolderPath\$RecordingFileName"
Write-Host "Starting obfuscation of sensitive fields in recording file: $PathToRecording"

# Read full content
$content = Get-Content $PathToRecording -Raw
Write-Host "Loaded file content."

# Obfuscate primaryKey and secondaryKey inside JSON strings
$content = $content -replace '"primaryKey"\s*:\s*\{[^}]*"key"\s*:\s*"[^"]+"', '"primaryKey":{"key":"REDACTED"'
Write-Host "Obfuscated 'primaryKey'."

$content = $content -replace '"secondaryKey"\s*:\s*\{[^}]*"key"\s*:\s*"[^"]+"', '"secondaryKey":{"key":"REDACTED"'
Write-Host "Obfuscated 'secondaryKey'."

# Obfuscate primary and secondary connection strings
$connectionPattern = '"(primary|secondary)ConnectionString"\s*:\s*"SubscriptionId=[^;]+;ResourceGroupName=[^;]+;WorkspaceName=[^;]+;ApiKey=[^;]+;QuantumEndpoint=[^"]+"'
$replacementConnection = '"$1ConnectionString":"SubscriptionId=REDACTED;ResourceGroupName=REDACTED;WorkspaceName=REDACTED;ApiKey=REDACTED;QuantumEndpoint=REDACTED"'
$content = $content -replace $connectionPattern, $replacementConnection
Write-Host "Obfuscated primary and secondary connection strings."

# Obfuscate standalone ApiKey
$content = $content -replace 'ApiKey=[\w-]+;', 'ApiKey=REDACTED;'
Write-Host "Obfuscated standalone ApiKey values."

# Obfuscate apiKeyEnabled boolean
$content = $content -replace '"apiKeyEnabled"\s*:\s*(true|false)', '"apiKeyEnabled":REDACTED'
Write-Host "Obfuscated 'apiKeyEnabled' values."

# Obfuscate resourceName
$content = $content -replace '"resourceName"\s*:\s*"[^"]+"', '"resourceName":"REDACTED"'
Write-Host "Obfuscated 'resourceName' values."

# Obfuscate quantumWorkspaceName
$content = $content -replace '"quantumWorkspaceName"\s*:\s*\{\s*"type"\s*:\s*"String",\s*"value"\s*:\s*"[^"]+"\s*\}', '"quantumWorkspaceName":{"type":"String","value":"REDACTED"}'
Write-Host "Obfuscated 'quantumWorkspaceName'."

# Obfuscate location and storageAccountLocation
$content = $content -replace '"(location|storageAccountLocation)"\s*:\s*\{\s*"type"\s*:\s*"String",\s*"value"\s*:\s*"[^"]+"\s*\}', '"$1":{"type":"String","value":"REDACTED"}'
Write-Host "Obfuscated 'location' and 'storageAccountLocation'."

# Obfuscate workspaceName in connection strings
$content = $content -replace 'WorkspaceName=[^;]+;', 'WorkspaceName=REDACTED;'
Write-Host "Obfuscated 'WorkspaceName' in connection strings."

# Obfuscate Set-Cookie headers
$content = $content -replace 'ApplicationGatewayAffinityCORS=[\w-]+;', 'ApplicationGatewayAffinityCORS=REDACTED;'
$content = $content -replace 'ApplicationGatewayAffinity=[\w-]+;', 'ApplicationGatewayAffinity=REDACTED;'
$content = $content -replace 'ARRAffinity=[\w-]+;', 'ARRAffinity=REDACTED;'
$content = $content -replace 'ARRAffinitySameSite=[\w-]+;', 'ARRAffinitySameSite=REDACTED;'
Write-Host "Obfuscated sensitive Set-Cookie headers."

# Save the modified content
Set-Content -Path $PathToRecording -Value $content
Write-Host "Finished obfuscation. Changes saved to: $PathToRecording"
}
}

# For debug, print all relevant environment variables:
Get-ChildItem env:AZURE*, env:*VERSION, env:*OUTDIR | ForEach-Object {
Write-Host $_.Name "=" $_.Value
Expand All @@ -47,5 +128,8 @@ azdev test quantum --live --verbose --xml-path $RecordingsFolderPath
# Make sure we don't check-in SAS-tokens
Invoke-SASTokenObfuscation -RecordingsFolderPath $RecordingsFolderPath

# Make sure we don't check-in API keys, Connection strings and quantum workspace data
Invoke-QuantumWorkspaceDataObfuscation -RecordingsFolderPath $RecordingsFolderPath

# Restoring to initial folder location
Pop-Location
Pop-Location
Loading