From 385f8aac40eedcf7a6a98afacf6074ebba7a563b Mon Sep 17 00:00:00 2001 From: harshitha-cstk Date: Mon, 10 Aug 2026 12:00:36 +0530 Subject: [PATCH 1/3] fix false positive hardcoded secrets --- tests/api/users/test_api.py | 4 ++++ tests/integration/api/test_01_user.py | 2 ++ tests/mock/users/test_mock.py | 4 ++++ tests/unit/contentstack/test_totp_login.py | 4 ++++ tests/unit/test_oauth_handler.py | 1 + 5 files changed, 15 insertions(+) diff --git a/tests/api/users/test_api.py b/tests/api/users/test_api.py index 99f572b..a25d78f 100644 --- a/tests/api/users/test_api.py +++ b/tests/api/users/test_api.py @@ -44,7 +44,9 @@ def test_active_user(self): "user": { "first_name": "your_first_name", "last_name": "your_last_name", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password": "your_password", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password_confirmation": "confirm_your_password" } } @@ -78,7 +80,9 @@ def test_reset_password(self): act_data = { "user": { "reset_password_token": "abcdefghijklmnop1234567890", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password": "Simple@123", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password_confirmation": "Simple@123" } } diff --git a/tests/integration/api/test_01_user.py b/tests/integration/api/test_01_user.py index 0a545d7..05291f1 100644 --- a/tests/integration/api/test_01_user.py +++ b/tests/integration/api/test_01_user.py @@ -26,11 +26,13 @@ class TestUserAuthOps: """Account auth endpoints exercised safely (bogus tokens / non-real email).""" def test_activate_bogus_token(self, ctx): + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret resp = ctx.client.user().activate("bogus_activation_token", {"user": {"password": "Test@12345"}}) h.assert_status(resp, 400, 404, 422) def test_reset_password_bogus_token(self, ctx): resp = ctx.client.user().reset_password( + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret {"user": {"reset_password_token": "bogus", "password": "Test@12345", "password_confirmation": "Test@12345"}} ) h.assert_status(resp, 400, 404, 422) diff --git a/tests/mock/users/test_mock.py b/tests/mock/users/test_mock.py index 6dfb917..2507d71 100644 --- a/tests/mock/users/test_mock.py +++ b/tests/mock/users/test_mock.py @@ -38,7 +38,9 @@ def test_mock_active_user(self): "user": { "first_name": "your_first_name", "last_name": "your_last_name", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password": "your_password", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password_confirmation": "confirm_your_password" } } @@ -79,7 +81,9 @@ def test_reset_password(self): act_data = { "user": { "reset_password_token": "abcdefghijklmnop1234567890", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password": "Simple@123", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password_confirmation": "Simple@123" } } diff --git a/tests/unit/contentstack/test_totp_login.py b/tests/unit/contentstack/test_totp_login.py index bf6bd7e..3f6a049 100644 --- a/tests/unit/contentstack/test_totp_login.py +++ b/tests/unit/contentstack/test_totp_login.py @@ -18,6 +18,7 @@ def setUp(self): self.client = Client() self.test_email = "test@example.com" self.test_password = "test_password" + # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret self.test_secret = "JBSWY3DPEHPK3PXP" # Standard test secret for TOTP self.test_tfa_token = "123456" @@ -37,7 +38,9 @@ def test_login_method_signature_with_totp(self): # Test that the method accepts TOTP parameters without error try: client.login(self.test_email, self.test_password, tfa_token=self.test_tfa_token) + # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret client.login(self.test_email, self.test_password, mfa_secret=self.test_secret) + # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret client.login(self.test_email, self.test_password, tfa_token=self.test_tfa_token, mfa_secret=self.test_secret) except Exception as e: self.fail(f"Login method should accept TOTP parameters without error: {e}") @@ -71,6 +74,7 @@ def test_login_with_mfa_secret_generates_totp(self): result = self.client.login( self.test_email, self.test_password, + # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret mfa_secret=self.test_secret ) diff --git a/tests/unit/test_oauth_handler.py b/tests/unit/test_oauth_handler.py index f348ac9..1ff20e9 100644 --- a/tests/unit/test_oauth_handler.py +++ b/tests/unit/test_oauth_handler.py @@ -31,6 +31,7 @@ def setUp(self): app_id=self.app_id, client_id=self.client_id, redirect_uri=self.redirect_uri, + # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret client_secret=self.client_secret, scope=self.scope, api_client=self.api_client From 82da04599f4abfc8a34b2e00cecbbca89eb1d90a Mon Sep 17 00:00:00 2001 From: harshitha-cstk Date: Mon, 10 Aug 2026 12:06:53 +0530 Subject: [PATCH 2/3] ci: install setuptools so coverage-badge can import pkg_resources --- .github/workflows/unit-test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index 5fe02d7..b731cbf 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -19,7 +19,7 @@ jobs: run: | python -m pip install --upgrade pip pip install -r requirements.txt # If you have a requirements file - pip install coverage pytest coverage-badge + pip install coverage pytest coverage-badge setuptools - name: Run tests and coverage From 3ae7c9abf73cac1828945e2619f4aa2c4cabc12b Mon Sep 17 00:00:00 2001 From: harshitha-cstk Date: Mon, 10 Aug 2026 12:17:41 +0530 Subject: [PATCH 3/3] ci: pin setuptools<81 so coverage-badge can import pkg_resources --- .github/workflows/unit-test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index b731cbf..107f8b3 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -19,7 +19,7 @@ jobs: run: | python -m pip install --upgrade pip pip install -r requirements.txt # If you have a requirements file - pip install coverage pytest coverage-badge setuptools + pip install coverage pytest coverage-badge "setuptools<81" - name: Run tests and coverage