From ae3ba7c6cfd761cf416e97d574dbc431245285cb Mon Sep 17 00:00:00 2001 From: reeshika-h Date: Mon, 10 Aug 2026 12:26:27 +0530 Subject: [PATCH] fix: suppress Snyk hardcoded-credential false positives in TestEntryModel Snyk Code flagged publish_details "user" test-fixture fields as hardcoded credentials (CWE-798). These are non-secret string values used only to populate mock JSON payloads, so add deepcode ignore annotations instead of leaving unscoped comments. --- src/test/java/com/contentstack/sdk/TestEntryModel.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/test/java/com/contentstack/sdk/TestEntryModel.java b/src/test/java/com/contentstack/sdk/TestEntryModel.java index f0a33237..cc1447da 100644 --- a/src/test/java/com/contentstack/sdk/TestEntryModel.java +++ b/src/test/java/com/contentstack/sdk/TestEntryModel.java @@ -254,7 +254,7 @@ void testConstructorWithPublishDetails() { JSONObject publishDetails = new JSONObject(); publishDetails.put("environment", "production"); publishDetails.put("time", "2024-01-01T00:00:00.000Z"); - // Test fixture: user is a non-secret publish-detail field (not a credential) + // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential publishDetails.put("user", "test_publisher_uid"); JSONObject json = new JSONObject(); @@ -331,6 +331,7 @@ void testConstructorWithAllFields() throws Exception { JSONObject publishDetails = new JSONObject(); publishDetails.put("environment", "staging"); publishDetails.put("time", "2024-02-01T12:00:00.000Z"); + // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential publishDetails.put("user", "admin"); // Create images array @@ -442,6 +443,7 @@ void testConstructorWithEntryKeyAndAllFields() throws Exception { JSONObject publishDetails = new JSONObject(); publishDetails.put("environment", "development"); publishDetails.put("time", "2024-03-01T15:00:00.000Z"); + // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential publishDetails.put("user", "dev_user"); // Create images