Merge pull request #181 from contentstack/fix/snyk-issues-secrets

fix false positive hardcoded secrets

Author: harshitha-cstk

.github/workflows/unit-test.yml

@@ -19,7 +19,7 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install -r requirements.txt  # If you have a requirements file
-          pip install coverage pytest coverage-badge
+          pip install coverage pytest coverage-badge "setuptools<81"
 
 
       - name: Run tests and coverage

tests/api/users/test_api.py

@@ -44,7 +44,9 @@ def test_active_user(self):
             "user": {
                 "first_name": "your_first_name",
                 "last_name": "your_last_name",
+                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
                 "password": "your_password",
+                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
                 "password_confirmation": "confirm_your_password"
             }
         }
@@ -78,7 +80,9 @@ def test_reset_password(self):
         act_data = {
             "user": {
                 "reset_password_token": "abcdefghijklmnop1234567890",
+                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
                 "password": "Simple@123",
+                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
                 "password_confirmation": "Simple@123"
             }
         }

tests/integration/api/test_01_user.py

@@ -26,11 +26,13 @@ class TestUserAuthOps:
     """Account auth endpoints exercised safely (bogus tokens / non-real email)."""
 
     def test_activate_bogus_token(self, ctx):
+        # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
         resp = ctx.client.user().activate("bogus_activation_token", {"user": {"password": "Test@12345"}})
         h.assert_status(resp, 400, 404, 422)
 
     def test_reset_password_bogus_token(self, ctx):
         resp = ctx.client.user().reset_password(
+            # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret            
             {"user": {"reset_password_token": "bogus", "password": "Test@12345", "password_confirmation": "Test@12345"}}
         )
         h.assert_status(resp, 400, 404, 422)

tests/mock/users/test_mock.py

@@ -38,7 +38,9 @@ def test_mock_active_user(self):
             "user": {
                 "first_name": "your_first_name",
                 "last_name": "your_last_name",
+                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
                 "password": "your_password",
+                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
                 "password_confirmation": "confirm_your_password"
             }
         }
@@ -79,7 +81,9 @@ def test_reset_password(self):
         act_data = {
             "user": {
                 "reset_password_token": "abcdefghijklmnop1234567890",
+                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
                 "password": "Simple@123",
+                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
                 "password_confirmation": "Simple@123"
             }
         }

tests/unit/contentstack/test_totp_login.py

@@ -18,6 +18,7 @@ def setUp(self):
         self.client = Client()
         self.test_email = "test@example.com"
         self.test_password = "test_password"
+        # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
         self.test_secret = "JBSWY3DPEHPK3PXP"  # Standard test secret for TOTP
         self.test_tfa_token = "123456"
 
@@ -37,7 +38,9 @@ def test_login_method_signature_with_totp(self):
         # Test that the method accepts TOTP parameters without error
         try:
             client.login(self.test_email, self.test_password, tfa_token=self.test_tfa_token)
+            # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
             client.login(self.test_email, self.test_password, mfa_secret=self.test_secret)
+            # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
             client.login(self.test_email, self.test_password, tfa_token=self.test_tfa_token, mfa_secret=self.test_secret)
         except Exception as e:
             self.fail(f"Login method should accept TOTP parameters without error: {e}")
@@ -71,6 +74,7 @@ def test_login_with_mfa_secret_generates_totp(self):
                     result = self.client.login(
                         self.test_email, 
                         self.test_password, 
+                        # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                         mfa_secret=self.test_secret
                     )
 

tests/unit/test_oauth_handler.py

@@ -31,6 +31,7 @@ def setUp(self):
             app_id=self.app_id,
             client_id=self.client_id,
             redirect_uri=self.redirect_uri,
+            # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
             client_secret=self.client_secret,
             scope=self.scope,
             api_client=self.api_client