Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Test hard coded credentials #8309

Closed
wants to merge 9 commits into from
Closed

Conversation

ngaruko
Copy link
Contributor

@ngaruko ngaruko commented Jun 8, 2023

Description

[description]

medic/cht-core#[number]

Code review checklist

  • Readable: Concise, well named, follows the style guide, documented if necessary.
  • Documented: Configuration and user documentation on cht-docs
  • Tested: Unit and/or e2e where appropriate
  • Internationalised: All user facing text
  • Backwards compatible: Works with existing data and configuration or includes a migration. Any breaking changes documented in the release notes.

Compose URLs

If Build CI hasn't passed, these may 404:

  • CHT_CORE_COMPOSE_URL
  • COUCH_SINGLE_COMPOSE_URL
  • COUCH_CLUSTER_COMPOSE_URL

License

The software is provided under AGPL-3.0. Contributions to this project are accepted under the same license.

await utils.request({
path: endpoint,
method: 'POST',
headers: { authorization: 'Token not the correct key' },

Check failure

Code scanning / CodeQL

Hard-coded credentials

The hard-coded value "Token not the correct key" is used as [authorization header](1).
const endpoint = '/api/v2/sms/rapidpro/incoming-messages';
const smsSettings = { outgoing_service: 'rapidpro' };

const INCOMING_KEY = 'thecakeisalie';

Check failure

Code scanning / CodeQL

Hard-coded credentials

The hard-coded value "thecakeisalie" is used as [authorization header](1). The hard-coded value "thecakeisalie" is used as [authorization header](2). The hard-coded value "thecakeisalie" is used as [authorization header](3). The hard-coded value "thecakeisalie" is used as [authorization header](4). The hard-coded value "thecakeisalie" is used as [authorization header](5).
@ngaruko ngaruko closed this Jun 24, 2023
@ngaruko ngaruko deleted the test-hard-coded-credentials branch June 24, 2023 03:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants