test: exhaustive coverage for the #91-#96 behavior - #97
Merged
Conversation
- Verhoeff: canonical examples, separators, embedded id runs, degenerate inputs (the p-permutation breaks the all-zero identity chain). - Luhn: known cards, separators, sub-13-digit rejection. - shannon_entropy: information-theory identities, hex near-ceiling, multi-byte input. - is_multiline: (?s), grouped (?s:...), combined (?is), negative flags, plain patterns — and a real fix the test caught: combined flags like (?is) missed the substring check, so such patterns were scanned line-by-line and silently missed multiline secrets. is_multiline now parses flag groups. - Every FP allowlist entry exercised in both directions through the real detector set (AWS example key, placeholders, example-domain emails, 555 numbers, checksum prefixes). - The false-positive corpus is committed under tests/fixtures and scanned end to end: exactly the two documented residuals may appear. - Finding derives Deserialize with a wire-format round-trip test: the historical plugin_name key and the detector_name alias both parse. - git-history mode gets a hostile-git-config test mirroring the staged one (pins GIT_DIFF_FRAMING_ARGS coverage for log). - stdin scans through NUL bytes; the secret after a NUL line is found.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds 32 tests pinning everything the recent PRs changed, at three levels:
Unit (src/detector.rs)
(?s), grouped(?s:...), combined(?is),(?i)-only, plain — and the test caught a real bug: combined flags like(?is)missed thecontains("(?s")check, so such patterns were scanned line-by-line and silently missed multiline secrets.is_multilinenow parses flag groups properly.Detector set (tests/detector_tests.rs)
Every allowlist entry from #96 exercised in both directions through the real detector set: AWS example key (allowlisted; any other AKIA reported), placeholders in five shapes across Password and GenericKeyValue detectors (mixed-case stays reported), example-domain/noreply emails vs real domains, 555 numbers vs real-shaped ones, checksum prefixes vs plain quoted strings.
Integration (tests/fixtures/fp_corpus + tests/fp_corpus_tests.rs)
The false-positive corpus from #96 is now a permanent regression fixture scanned end to end: exactly the two documented residuals may appear, and a second test asserts the six most-noisy detector types never fire on it. Plus a wire-format round-trip test (Finding serializes as
plugin_name, deserializes from both keys), a hostile-git-config test for--git-history(pins GIT_DIFF_FRAMING_ARGS coverage for log, mirroring the staged one), and a stdin-NUL scan-through test.Tests
232 pass (was 216; +16). fmt/clippy clean.