Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Decouple tests from specific encryption implementation #640

Open
MrSebastian opened this issue Dec 11, 2024 · 0 comments
Open

Decouple tests from specific encryption implementation #640

MrSebastian opened this issue Dec 11, 2024 · 0 comments

Comments

@MrSebastian
Copy link
Member

          _:hammer_and_wrench: Refactor suggestion_

Decouple tests from specific encryption implementation

The test contains hardcoded encrypted values which make it brittle to encryption changes.

Consider generating the encrypted values dynamically:

-    private static final String USERNAME_ENCRYPTED = "ENCRYPTED:TLXm2wsx1kcDLHHU8ZWptQ==";
+    @Autowired
+    private CryptoService cryptoService;
+    
+    private String getEncryptedUsername() {
+        return "ENCRYPTED:" + cryptoService.encrypt(USERNAME_UNENCRYPTED);
+    }

Then replace USERNAME_ENCRYPTED usage with getEncryptedUsername() in tests.

Also applies to: 27-27


⚠️ Potential issue

Security: Remove sensitive test key from source code

Similar to the CryptoServiceIntegrationTest, the encryption key should not be hardcoded.

Move the test key to a secure test configuration file:

-@SpringBootTest(classes = MicroServiceApplication.class, properties = { "service.config.crypto.key=veryLongAndVerySaveKeyIHopeXXXabc123!!" })
+@SpringBootTest(classes = MicroServiceApplication.class)

Committable suggestion skipped: line range outside the PR's diff.

Originally posted by @coderabbitai[bot] in #635 (comment)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant