Skip to content

Commit a2bef25

Browse files
jviaujviau
authored
[1es] [CG] Fix/suppress cred scan hits in test files (#10046)
* Fix/suppress cred scan hits in test files * Extract emulator account key * Ensure test encryption key is thread safe * Use full emulator conn string * Fix TestHelpers init order
1 parent 8f19cf6 commit a2bef25

File tree

11 files changed

+106
-117
lines changed

11 files changed

+106
-117
lines changed

‎test/WebJobs.Script.Tests.Integration/Management/InstanceControllerTests.cs

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,6 @@ public async Task Assign_MSISpecializationFailure_ReturnsError()
6969

7070
var instanceController = new InstanceController(environment, instanceManager, loggerFactory, startupContextProvider);
7171

72-
const string containerEncryptionKey = "/a/vXvWJ3Hzgx4PFxlDUJJhQm5QVyGiu0NNLFm/ZMMg=";
7372
var hostAssignmentContext = new HostAssignmentContext
7473
{
7574
Environment = new Dictionary<string, string>(),
@@ -79,14 +78,14 @@ public async Task Assign_MSISpecializationFailure_ReturnsError()
7978
hostAssignmentContext.Environment[EnvironmentSettingNames.MsiEndpoint] = "http://localhost:8081";
8079
hostAssignmentContext.Environment[EnvironmentSettingNames.MsiSecret] = "secret";
8180

82-
var encryptedHostAssignmentValue = SimpleWebTokenHelper.Encrypt(JsonConvert.SerializeObject(hostAssignmentContext), containerEncryptionKey.ToKeyBytes());
81+
var encryptedHostAssignmentValue = SimpleWebTokenHelper.Encrypt(JsonConvert.SerializeObject(hostAssignmentContext), TestHelpers.EncryptionKey.ToKeyBytes());
8382

8483
var encryptedHostAssignmentContext = new EncryptedHostAssignmentContext()
8584
{
8685
EncryptedContext = encryptedHostAssignmentValue
8786
};
8887

89-
environment.SetEnvironmentVariable(EnvironmentSettingNames.ContainerEncryptionKey, containerEncryptionKey);
88+
environment.SetEnvironmentVariable(EnvironmentSettingNames.ContainerEncryptionKey, TestHelpers.EncryptionKey);
9089

9190
IActionResult result = await instanceController.Assign(encryptedHostAssignmentContext);
9291

@@ -145,7 +144,6 @@ public async Task Assignment_Sets_Secrets_Context()
145144

146145
var instanceController = new InstanceController(environment, instanceManager, loggerFactory, startupContextProvider);
147146

148-
const string containerEncryptionKey = "/a/vXvWJ3Hzgx4PFxlDUJJhQm5QVyGiu0NNLFm/ZMMg=";
149147
var hostAssignmentContext = new HostAssignmentContext
150148
{
151149
Environment = new Dictionary<string, string>()
@@ -156,14 +154,14 @@ public async Task Assignment_Sets_Secrets_Context()
156154
hostAssignmentContext.Secrets = new FunctionAppSecrets();
157155
hostAssignmentContext.IsWarmupRequest = false; // non-warmup Request
158156

159-
var encryptedHostAssignmentValue = SimpleWebTokenHelper.Encrypt(JsonConvert.SerializeObject(hostAssignmentContext), containerEncryptionKey.ToKeyBytes());
157+
var encryptedHostAssignmentValue = SimpleWebTokenHelper.Encrypt(JsonConvert.SerializeObject(hostAssignmentContext), TestHelpers.EncryptionKey.ToKeyBytes());
160158

161159
var encryptedHostAssignmentContext = new EncryptedHostAssignmentContext()
162160
{
163161
EncryptedContext = encryptedHostAssignmentValue
164162
};
165163

166-
environment.SetEnvironmentVariable(EnvironmentSettingNames.ContainerEncryptionKey, containerEncryptionKey);
164+
environment.SetEnvironmentVariable(EnvironmentSettingNames.ContainerEncryptionKey, TestHelpers.EncryptionKey);
167165

168166
await instanceController.Assign(encryptedHostAssignmentContext);
169167
Assert.NotNull(startupContextProvider.Context);
@@ -199,7 +197,6 @@ public async Task Assignment_Does_Not_Set_Secrets_Context_For_Warmup_Request()
199197

200198
var instanceController = new InstanceController(environment, instanceManager, loggerFactory, startupContextProvider);
201199

202-
const string containerEncryptionKey = "/a/vXvWJ3Hzgx4PFxlDUJJhQm5QVyGiu0NNLFm/ZMMg=";
203200
var hostAssignmentContext = new HostAssignmentContext
204201
{
205202
Environment = new Dictionary<string, string>()
@@ -210,14 +207,14 @@ public async Task Assignment_Does_Not_Set_Secrets_Context_For_Warmup_Request()
210207
hostAssignmentContext.Secrets = new FunctionAppSecrets();
211208
hostAssignmentContext.IsWarmupRequest = true; // Warmup Request
212209

213-
var encryptedHostAssignmentValue = SimpleWebTokenHelper.Encrypt(JsonConvert.SerializeObject(hostAssignmentContext), containerEncryptionKey.ToKeyBytes());
210+
var encryptedHostAssignmentValue = SimpleWebTokenHelper.Encrypt(JsonConvert.SerializeObject(hostAssignmentContext), TestHelpers.EncryptionKey.ToKeyBytes());
214211

215212
var encryptedHostAssignmentContext = new EncryptedHostAssignmentContext()
216213
{
217214
EncryptedContext = encryptedHostAssignmentValue
218215
};
219216

220-
environment.SetEnvironmentVariable(EnvironmentSettingNames.ContainerEncryptionKey, containerEncryptionKey);
217+
environment.SetEnvironmentVariable(EnvironmentSettingNames.ContainerEncryptionKey, TestHelpers.EncryptionKey);
221218

222219
await instanceController.Assign(encryptedHostAssignmentContext);
223220
Assert.Null(startupContextProvider.Context);
@@ -243,7 +240,6 @@ public async Task Assignment_Invokes_InstanceManager_Methods_For_Warmup_Requests
243240
var instanceController = new InstanceController(environment, instanceManager.Object, loggerFactory,
244241
startupContextProvider);
245242

246-
const string containerEncryptionKey = "/a/vXvWJ3Hzgx4PFxlDUJJhQm5QVyGiu0NNLFm/ZMMg=";
247243
var hostAssignmentContext = new HostAssignmentContext
248244
{
249245
Environment = new Dictionary<string, string>()
@@ -252,14 +248,14 @@ public async Task Assignment_Invokes_InstanceManager_Methods_For_Warmup_Requests
252248

253249
var encryptedHostAssignmentValue =
254250
SimpleWebTokenHelper.Encrypt(JsonConvert.SerializeObject(hostAssignmentContext),
255-
containerEncryptionKey.ToKeyBytes());
251+
TestHelpers.EncryptionKey.ToKeyBytes());
256252

257253
var encryptedHostAssignmentContext = new EncryptedHostAssignmentContext()
258254
{
259255
EncryptedContext = encryptedHostAssignmentValue
260256
};
261257

262-
environment.SetEnvironmentVariable(EnvironmentSettingNames.ContainerEncryptionKey, containerEncryptionKey);
258+
environment.SetEnvironmentVariable(EnvironmentSettingNames.ContainerEncryptionKey, TestHelpers.EncryptionKey);
263259

264260
await instanceController.Assign(encryptedHostAssignmentContext);
265261

‎test/WebJobs.Script.Tests.Integration/Management/InstanceManagerTests.cs

Lines changed: 12 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
using System;
55
using System.Collections.Generic;
66
using System.IO;
7-
using System.IO.Abstractions;
87
using System.Linq;
98
using System.Net;
109
using System.Net.Http;
@@ -376,9 +375,9 @@ public async Task ValidateContext_InvalidZipUrl_WebsiteUseZip_ReturnsError()
376375
handlerMock.Protected().Setup<Task<HttpResponseMessage>>("SendAsync",
377376
ItExpr.IsAny<HttpRequestMessage>(),
378377
ItExpr.IsAny<CancellationToken>()).ReturnsAsync(new HttpResponseMessage
379-
{
380-
StatusCode = HttpStatusCode.NotFound
381-
});
378+
{
379+
StatusCode = HttpStatusCode.NotFound
380+
});
382381

383382
var instanceManager = new AtlasInstanceManager(_optionsFactory, TestHelpers.CreateHttpClientFactory(handlerMock.Object),
384383
scriptWebEnvironment, environment, loggerFactory.CreateLogger<AtlasInstanceManager>(),
@@ -687,7 +686,7 @@ public async Task SpecializeMsiSidecar_RequiredPropertiesInPayload()
687686
var environment = new Dictionary<string, string>()
688687
{
689688
{ EnvironmentSettingNames.MsiEndpoint, "http://localhost:8081" },
690-
{ EnvironmentSettingNames.MsiSecret, "secret" }
689+
{ EnvironmentSettingNames.MsiSecret, "PLACEHOLDER" }
691690
};
692691
var assignmentContext = new HostAssignmentContext
693692
{
@@ -698,55 +697,14 @@ public async Task SpecializeMsiSidecar_RequiredPropertiesInPayload()
698697
MSIContext = new MSIContext()
699698
{
700699
SiteName = "TestSite",
701-
MSISecret = "TestSecret1234",
702-
Identities = new[] { new ManagedServiceIdentity() {
703-
Type = ManagedServiceIdentityType.SystemAssigned,
704-
ClientId = "identityClientId",
705-
TenantId = "identityTenantId",
706-
Thumbprint = "identityThumbprint",
707-
SecretUrl = "identitySecretUrl",
708-
ResourceId = "identityResourceId",
709-
Certificate = "identityCertificate",
710-
PrincipalId = "identityPrincipalId",
711-
AuthenticationEndpoint = "identityAuthEndpoint"
712-
} },
713-
SystemAssignedIdentity = new ManagedServiceIdentity()
714-
{
715-
Type = ManagedServiceIdentityType.SystemAssigned,
716-
ClientId = "saClientId",
717-
TenantId = "saTenantId",
718-
Thumbprint = "saThumbprint",
719-
SecretUrl = "saSecretUrl",
720-
ResourceId = "saResourceId",
721-
Certificate = "saCertificate",
722-
PrincipalId = "saPrincipalId",
723-
AuthenticationEndpoint = "saAuthEndpoint"
724-
},
725-
DelegatedIdentities = new[] { new ManagedServiceIdentity() {
726-
Type = ManagedServiceIdentityType.SystemAssigned,
727-
ClientId = "delegatedClientId",
728-
TenantId = "delegatedTenantId",
729-
Thumbprint = "delegatedThumbprint",
730-
SecretUrl = "delegatedSecretUrl",
731-
ResourceId = "delegatedResourceId",
732-
Certificate = "delegatedCertificate",
733-
PrincipalId = "delegatedPrincipalId",
734-
AuthenticationEndpoint = "delegatedAuthEndpoint"
735-
} },
736-
UserAssignedIdentities = new[] { new ManagedServiceIdentity() {
737-
Type = ManagedServiceIdentityType.UserAssigned,
738-
ClientId = "uaClientId",
739-
TenantId = "uaTenantId",
740-
Thumbprint = "uaThumbprint",
741-
SecretUrl = "uaSecretUrl",
742-
ResourceId = "uaResourceId",
743-
Certificate = "uaCertificate",
744-
PrincipalId = "uaPrincipalId",
745-
AuthenticationEndpoint = "uaAuthEndpoint"
746-
} },
700+
MSISecret = "PLACEHOLDER",
701+
Identities = new[] { TestHelpers.CreateMsi(ManagedServiceIdentityType.SystemAssigned, "identity") },
702+
SystemAssignedIdentity = TestHelpers.CreateMsi(ManagedServiceIdentityType.SystemAssigned, "sa"),
703+
DelegatedIdentities = new[] { TestHelpers.CreateMsi(ManagedServiceIdentityType.SystemAssigned, "delegated") },
704+
UserAssignedIdentities = new[] { TestHelpers.CreateMsi(ManagedServiceIdentityType.UserAssigned, "ua") },
747705
}
748706
};
749-
707+
750708
static void verifyMSIPropertiesHelper(ManagedServiceIdentity msi)
751709
{
752710
Assert.NotNull(msi);
@@ -1160,7 +1118,7 @@ public async void Falls_Back_To_Local_Disk_If_Azure_Files_Unavailable_For_PowerS
11601118

11611119
var runFromPackageHandler = new Mock<IRunFromPackageHandler>(MockBehavior.Strict);
11621120
runFromPackageHandler.Setup(r => r.MountAzureFileShare(context)).Returns(Task.FromResult(true));
1163-
1121+
11641122
runFromPackageHandler
11651123
.Setup(r => r.ApplyRunFromPackageContext(It.IsAny<RunFromPackageContext>(), It.IsAny<string>(), true,
11661124
false)).ReturnsAsync(false); // return false to trigger failure
@@ -1444,7 +1402,7 @@ private AtlasInstanceManager GetInstanceManagerForMSISpecialization(HostAssignme
14441402

14451403
handlerMock.Protected().Setup<Task<HttpResponseMessage>>("SendAsync",
14461404
ItExpr.Is<HttpRequestMessage>(request => request.Method == HttpMethod.Post
1447-
&& (request.RequestUri.AbsoluteUri.Equals(msiEndpoint)
1405+
&& (request.RequestUri.AbsoluteUri.Equals(msiEndpoint)
14481406
|| request.RequestUri.AbsoluteUri.Equals(defaultEncryptedMsiEndpoint)
14491407
|| request.RequestUri.AbsoluteUri.Equals(providedEncryptedMsiEndpoint))
14501408
&& request.Content != null),

‎test/WebJobs.Script.Tests.Integration/Management/KubernetesPodControllerTests.cs

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,6 @@ public async Task Assignment_Succeeds_With_Encryption_Key()
6060

6161
var podController = new KubernetesPodController(environment, instanceManager, loggerFactory, startupContextProvider);
6262

63-
const string podEncryptionKey = "/a/vXvWJ3Hzgx4PFxlDUJJhQm5QVyGiu0NNLFm/ZMMg=";
6463
var hostAssignmentContext = new HostAssignmentContext
6564
{
6665
Environment = new Dictionary<string, string>()
@@ -71,14 +70,15 @@ public async Task Assignment_Succeeds_With_Encryption_Key()
7170
hostAssignmentContext.Secrets = new FunctionAppSecrets();
7271
hostAssignmentContext.IsWarmupRequest = false;
7372

74-
var encryptedHostAssignmentValue = SimpleWebTokenHelper.Encrypt(JsonConvert.SerializeObject(hostAssignmentContext), podEncryptionKey.ToKeyBytes());
73+
var encryptedHostAssignmentValue = SimpleWebTokenHelper.Encrypt(
74+
JsonConvert.SerializeObject(hostAssignmentContext), TestHelpers.EncryptionKey.ToKeyBytes());
7575

7676
var encryptedHostAssignmentContext = new EncryptedHostAssignmentContext()
7777
{
7878
EncryptedContext = encryptedHostAssignmentValue
7979
};
8080

81-
environment.SetEnvironmentVariable(EnvironmentSettingNames.PodEncryptionKey, podEncryptionKey);
81+
environment.SetEnvironmentVariable(EnvironmentSettingNames.PodEncryptionKey, TestHelpers.EncryptionKey);
8282
environment.SetEnvironmentVariable(EnvironmentSettingNames.KubernetesServiceHost, "http://localhost:80");
8383
environment.SetEnvironmentVariable(EnvironmentSettingNames.PodNamespace, "k8se-apps");
8484

@@ -116,7 +116,6 @@ public async Task Assignment_Fails_Without_Encryption_Key()
116116

117117
instanceManager.Reset();
118118

119-
const string podEncryptionKey = "/a/vXvWJ3Hzgx4PFxlDUJJhQm5QVyGiu0NNLFm/ZMMg=";
120119
var podController = new KubernetesPodController(environment, instanceManager, loggerFactory, startupContextProvider);
121120

122121
var hostAssignmentContext = new HostAssignmentContext
@@ -129,7 +128,8 @@ public async Task Assignment_Fails_Without_Encryption_Key()
129128
hostAssignmentContext.Secrets = new FunctionAppSecrets();
130129
hostAssignmentContext.IsWarmupRequest = false;
131130

132-
var encryptedHostAssignmentValue = SimpleWebTokenHelper.Encrypt(JsonConvert.SerializeObject(hostAssignmentContext), podEncryptionKey.ToKeyBytes());
131+
var encryptedHostAssignmentValue = SimpleWebTokenHelper.Encrypt(
132+
JsonConvert.SerializeObject(hostAssignmentContext), TestHelpers.EncryptionKey.ToKeyBytes());
133133

134134
var encryptedHostAssignmentContext = new EncryptedHostAssignmentContext()
135135
{

‎test/WebJobs.Script.Tests.Integration/Management/MeshServiceClientTests.cs

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -80,10 +80,7 @@ public async Task MountsCifsShare()
8080
StatusCode = HttpStatusCode.OK
8181
});
8282

83-
var connectionString =
84-
"DefaultEndpointsProtocol=https;AccountName=storageaccount;AccountKey=whXtW6WP8QTh84TT5wdjgzeFTj7Vc1aOiCVjTXohpE+jALoKOQ9nlQpj5C5zpgseVJxEVbaAhptP5j5DpaLgtA==";
85-
86-
await _meshServiceClient.MountCifs(connectionString, "sharename", "/data");
83+
await _meshServiceClient.MountCifs(TestHelpers.StorageEmulatorConnectionString, "sharename", "/data");
8784

8885
await Task.Delay(500);
8986

‎test/WebJobs.Script.Tests.Shared/TestHelpers.Constants.cs

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
// Copyright (c) .NET Foundation. All rights reserved.
2+
// Licensed under the MIT License. See License.txt in the project root for license information.
3+
4+
using System;
5+
using System.Diagnostics.CodeAnalysis;
6+
using System.IO;
7+
using System.Security.Cryptography;
8+
9+
namespace Microsoft.Azure.WebJobs.Script.Tests
10+
{
11+
public static partial class TestHelpers
12+
{
13+
[SuppressMessage("Microsoft.Security", "CS002:SecretInNextLine", Justification = "Well known account key for emulator. Used for testing.")]
14+
public static readonly string StorageEmulatorAccountKey = "Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==";
15+
public static readonly string StorageEmulatorConnectionString = $"DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey={StorageEmulatorAccountKey}";
16+
17+
private static readonly Lazy<string> _encryptionKey = new Lazy<string>(
18+
() =>
19+
{
20+
using Aes aes = Aes.Create();
21+
aes.GenerateKey();
22+
return Convert.ToBase64String(aes.Key);
23+
});
24+
25+
public static string EncryptionKey => _encryptionKey.Value;
26+
27+
/// <summary>
28+
/// Gets the common root directory that functions tests create temporary directories under.
29+
/// This enables us to clean up test files by deleting this single directory.
30+
/// </summary>
31+
public static string FunctionsTestDirectory
32+
{
33+
get
34+
{
35+
return Path.Combine(Path.GetTempPath(), "FunctionsTest");
36+
}
37+
}
38+
}
39+
}

‎test/WebJobs.Script.Tests.Shared/TestHelpers.cs

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
using System;
55
using System.Collections.Generic;
66
using System.Diagnostics;
7-
using System.Diagnostics.Metrics;
87
using System.IO;
98
using System.IO.Compression;
109
using System.Linq;
@@ -17,8 +16,8 @@
1716
using Microsoft.Azure.Storage;
1817
using Microsoft.Azure.Storage.Blob;
1918
using Microsoft.Azure.WebJobs.Host.Storage;
20-
using Microsoft.Azure.WebJobs.Script.Metrics;
2119
using Microsoft.Azure.WebJobs.Script.WebHost;
20+
using Microsoft.Azure.WebJobs.Script.WebHost.Models;
2221
using Microsoft.Azure.WebJobs.Script.Workers;
2322
using Microsoft.Azure.WebJobs.Script.Workers.Rpc;
2423
using Microsoft.Extensions.Azure;
@@ -36,18 +35,6 @@ public static partial class TestHelpers
3635
private const string Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
3736
private static readonly Random Random = new Random();
3837

39-
/// <summary>
40-
/// Gets the common root directory that functions tests create temporary directories under.
41-
/// This enables us to clean up test files by deleting this single directory.
42-
/// </summary>
43-
public static string FunctionsTestDirectory
44-
{
45-
get
46-
{
47-
return Path.Combine(Path.GetTempPath(), "FunctionsTest");
48-
}
49-
}
50-
5138
public static Task WaitOneAsync(this WaitHandle waitHandle)
5239
{
5340
ArgumentNullException.ThrowIfNull(waitHandle);
@@ -116,8 +103,8 @@ public static async Task Await(Func<Task<bool>> condition, int timeout = 60 * 10
116103
}
117104
throw new ApplicationException(error);
118105
}
119-
}
120106
}
107+
}
121108

122109
public static async Task RetryFailedTest(Func<Task> test, int retries, ITestOutputHelper output = null)
123110
{
@@ -540,6 +527,22 @@ public static IHttpClientFactory CreateHttpClientFactory(HttpMessageHandler hand
540527
return mockFactory.Object;
541528
}
542529

530+
public static ManagedServiceIdentity CreateMsi(ManagedServiceIdentityType type, string prefix)
531+
{
532+
return new ManagedServiceIdentity
533+
{
534+
Type = type,
535+
ClientId = $"{prefix}-clientId-placeholder",
536+
PrincipalId = $"{prefix}-principalId-placeholder",
537+
TenantId = $"{prefix}-tenantId-placeholder",
538+
Thumbprint = $"{prefix}-thumbprint-placeholder",
539+
SecretUrl = $"{prefix}-secretUrl-placeholder",
540+
ResourceId = $"{prefix}-resourceId-placeholder",
541+
Certificate = $"{prefix}-certificate-placeholder",
542+
AuthenticationEndpoint = $"{prefix}-authenticationEndpoint-placeholder",
543+
};
544+
}
545+
543546
/// <summary>
544547
/// Test class for IScriptHostManager to register an IAzureBlobStorageProvider.
545548
/// </summary>

0 commit comments

Comments
 (0)