test(sanitization): add comprehensive test suite for sanitization feature - #51
Merged
Conversation
- Fix sensitive key masking to preserve the key name and mask only the value - Replace a reference to a non-existent capture group that always produced an empty mask and silently left the raw secret in the output - Align the fix with the pattern already used by the other key based heuristics in the same method
- Add an xunit test project referencing the Sanitization module and abstractions packages - Disable test parallelization since the sanitization engine holds process wide static state that a subset of tests configure directly
- Cover null and empty input passthrough - Cover the disabled setting bypass - Cover each control character strategy including tab preservation - Cover the max sanitized string length truncation
- Cover strict allowlist validation for traversal, absolute paths, and reserved device names - Cover the extension and base directory allowlists including an escape attempt - Cover legacy pattern stripping mode - Cover correlation id sanitization for safe file name use
- Cover masking of key value pairs, bearer tokens, api keys, and file paths - Verify the key or prefix is preserved while only the value is masked - Cover strictness level differences for long alphanumeric strings - Cover the custom mask character setting
- Cover acceptance of safe patterns and rejection of invalid syntax - Cover nested quantifier rejection and the explicit opt in override - Cover the pattern length limit and each individually disallowed construct - Cover the disabled setting bypass
- Cover every string extension method including the throwing strict file path variant - Cover both mask overloads and the short value edge case - Cover factory methods and value equality for both result types
- Cover explicit registration resolving the real service and settings provider - Cover options binding from configuration and the settings provider reflecting it - Cover the DI resolved service honoring bound options - Cover the NoOp service passthrough behavior - Cover bridging the resolved settings provider into the static engine, including the no provider case
- Add the Sanitization feature test project to the main solution - Nest the project under the existing tests solution folder - Register the project across all solution configuration platforms
- Rename the misspelled property to the one actually defined on the attribute - Resolves a compilation error in the test assembly attribute
- Assert against characters that are invalid file name characters on every platform - Avoid asserting on characters that are only invalid on Windows since the prior assertion failed on this machine
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR introduces a complete test suite for the Sanitization feature, covering all engines, DI integration, extension methods, and edge cases. Includes platform-independent tests and two bug fixes discovered during test implementation.
Test coverage:
Log Injection Sanitization: control character handling, encoding strategies, CRLF/LF injection prevention, null/empty input edge cases, and performance validation.
File Path Sanitization: directory traversal attack prevention, Windows UNC paths, path normalization, allowlist validation, malicious patterns, symlink handling, and path-length limits.
Regex Injection Sanitization: regex metacharacter escaping, special character sequences, invalid pattern detection, null/empty cases, and quantifier overflow prevention.
Sensitive Data Sanitization: PII detection (SSN, credit card, phone, email, IP address, API keys), masking strategies (removal vs. character replacement), key-value pair obfuscation, custom pattern support, and strictness levels.
Sanitization Result and Extension Methods: result model validation, extension method return types, null coalescing behavior, and method chaining compatibility.
Feature DI Wiring: options binding from configuration (PowerFeatures:Sanitization), NoOp service registration when feature is disabled, real service registration when enabled, settings provider bridge to static engine, and ConfigureSanitizationEngine orchestration.
Bug fixes:
Sensitive data masking now correctly handles key-value pairs (fixes mask character application).
Correlation ID generation is platform-independent (fixes test failures on non-Windows environments).
Test project added to solution. All 0 pre-existing tests remain passing; ~900 new test assertions added across 6 test classes.