Skip to content

test: remove privacy data from test case#6803

Merged
Soulter merged 1 commit intoAstrBotDevs:masterfrom
whatevertogo:fix/remove-privacy-test-data
Mar 22, 2026
Merged

test: remove privacy data from test case#6803
Soulter merged 1 commit intoAstrBotDevs:masterfrom
whatevertogo:fix/remove-privacy-test-data

Conversation

@whatevertogo
Copy link
Contributor

@whatevertogo whatevertogo commented Mar 22, 2026

Remove test case test_poke_to_dict_keeps_legacy_qq_compatible which contains a real QQ number (2916963017) in the test data. This is a privacy concern as the test code is public and contains personally identifiable information.

The removed test was checking legacy QQ compatibility behavior, but this functionality can be verified without using real user data. Other tests in the same file already cover the poke functionality using generic test data (id=2003).

移除包含真实 QQ 号码的测试用例 test_poke_to_dict_keeps_legacy_qq_compatible。测试代码是公开的,包含真实用户数据存在隐私泄露风险。

被移除的测试用于验证旧版 QQ 兼容性,但此功能可以使用通用测试数据(如 id=2003)进行验证,无需使用真实用户数据。

Modifications / 改动点

  • tests/unit/test_aiocqhttp_poke.py: Removed test_poke_to_dict_keeps_legacy_qq_compatible test function that contained real QQ number

  • This is NOT a breaking change. / 这不是一个破坏性变更。

Screenshots or Test Results / 运行截图或测试结果

Test results after removing the privacy data test:

============================= test session starts =============================
platform win32 -- Python 3.12.12, pytest-9.0.2, pluggy-1.6.0
rootdir: D:\GitObjectsOwn\AstrbotAll\AstrBot
configfile: pyproject.toml
plugins: anyio-4.12.1, asyncio-1.3.0, cov-7.0.0
asyncio: mode=Mode.STRICT, debug=False

tests/unit/test_aiocqhttp_poke.py::test_poke_to_dict_matches_onebot_v11_segment_format PASSED [ 25%]
tests/unit/test_aiocqhttp_poke.py::test_respond_stage_treats_poke_with_target_as_non_empty PASSED [ 50%]
tests/unit/test_aiocqhttp_poke.py::test_aiocqhttp_parse_json_outputs_standard_poke_data PASSED [ 75%]
tests/unit/test_aiocqhttp_poke.py::test_aiocqhttp_send_message_dispatches_onebot_v11_poke_payload PASSED [100%]

======================== 4 passed, 3 warnings in 8.46s ========================

All remaining tests pass. The poke functionality is still covered by other test cases using generic test data.


Checklist / 检查清单

  • 😊 If there are new features added in the PR, I have discussed it with the authors through issues/emails, etc.
    / 如果 PR 中有新加入的功能,已经通过 Issue / 邮件等方式和作者讨论过。

  • 👀 My changes have been well-tested, and "Verification Steps" and "Screenshots" have been provided above.
    / 我的更改经过了良好的测试,并已在上方提供了"验证步骤"和"运行截图"

  • 🤓 I have ensured that no new dependencies are introduced, OR if new dependencies are introduced, they have been added to the appropriate locations in requirements.txt and pyproject.toml.
    / 我确保没有引入新依赖库,或者引入了新依赖库的同时将其添加到 requirements.txtpyproject.toml 文件相应位置。

  • 😮 My changes do not introduce malicious code.
    / 我的更改没有引入恶意代码。

Summary by Sourcery

Remove a unit test that embeds real QQ account data to eliminate sensitive information from the test suite.

Tests:

  • Delete the legacy compatibility poke test that used a real QQ identifier, relying on existing generic-data poke tests for coverage.

Chores:

  • Sanitize the codebase by removing personally identifiable information from test data.

Copilot AI review requested due to automatic review settings March 22, 2026 13:27
@dosubot dosubot bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Mar 22, 2026
@gemini-code-assist
Copy link
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on improving data privacy within the project's test suite. It addresses a potential privacy concern by removing a specific test case that inadvertently exposed personally identifiable information (a real QQ number) in public code. The change ensures that the system's functionality remains thoroughly tested without compromising user data, maintaining test coverage through existing, generalized test cases.

Highlights

  • Privacy Enhancement: Removed a test case containing a real QQ number (2916963017) from test_aiocqhttp_poke.py to prevent privacy leakage, as the test code is public.
  • Test Refinement: Ensured that the functionality previously covered by the removed test case is still adequately verified by other existing tests using generic data.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link
Contributor

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've left some high level feedback:

  • Instead of removing test_poke_to_dict_keeps_legacy_qq_compatible entirely, consider re-adding a similar test that verifies the legacy compatibility behavior using a clearly fake/non-PII ID (e.g., a small test-only integer) so that the behavior remains explicitly covered without privacy risk.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- Instead of removing `test_poke_to_dict_keeps_legacy_qq_compatible` entirely, consider re-adding a similar test that verifies the legacy compatibility behavior using a clearly fake/non-PII ID (e.g., a small test-only integer) so that the behavior remains explicitly covered without privacy risk.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request removes a test case that contained a real QQ number, which is a good step for privacy. However, in doing so, it also removes test coverage for a legacy compatibility feature. I've suggested restoring the test but with a dummy QQ number to maintain test coverage while still addressing the privacy concern.

I am having trouble creating individual review comments. Click here to see my feedback.

tests/unit/test_aiocqhttp_poke.py (21-26)

medium

While removing the real QQ number is correct, deleting this entire test case removes test coverage for the legacy qq parameter in Comp.Poke. This test is the only one that verifies the backward compatibility for the qq field. It's better to keep the test and replace the real QQ number with a dummy one to maintain test coverage.

def test_poke_to_dict_keeps_legacy_qq_compatible():
    poke = Comp.Poke(type="poke", qq=1234567890)
    assert poke.toDict() == {
        "type": "poke",
        "data": {"type": "126", "id": "1234567890"},
    }

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Removes a unit test that contained a real QQ number to avoid committing personally identifiable information (PII) into the public test suite.

Changes:

  • Deleted test_poke_to_dict_keeps_legacy_qq_compatible from the poke-related unit tests.
  • Kept existing poke tests that use generic test data (e.g., id=2003) and confirmed the suite still passes.

@@ -18,14 +18,6 @@ def test_poke_to_dict_matches_onebot_v11_segment_format():
}


Copy link

Copilot AI Mar 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This removal drops the only regression test that verifies the Comp.Poke legacy/compat behavior (accepting the old signature type="poke" and the deprecated qq field, which is still explicitly supported in astrbot/core/message/components.py). To keep coverage while addressing privacy, consider re-adding an equivalent test using clearly synthetic, non-user-identifying data (e.g., a non-real string id) so that legacy compatibility remains protected from regressions.

Suggested change
def test_poke_legacy_signature_with_qq_field_is_supported():
poke = Comp.Poke(type="poke", qq="synthetic_qq_id")
assert poke.toDict() == {
"type": "poke",
"data": {"qq": "synthetic_qq_id"},
}

Copilot uses AI. Check for mistakes.
@dosubot dosubot bot added the lgtm This PR has been approved by a maintainer label Mar 22, 2026
@Soulter Soulter merged commit e9b1dd3 into AstrBotDevs:master Mar 22, 2026
10 of 11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

lgtm This PR has been approved by a maintainer size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants