Function TestSecurityTokenLeakage

pkg/workflow/security_regression_test.go:423–465

TestSecurityTokenLeakage validates that tokens cannot be leaked through various expression paths.

(t *testing.T)

// TestSecurityTokenLeakage validates that tokens cannot be leaked through
// various expression paths.
func TestSecurityTokenLeakage(t *testing.T) {
	tests := []struct {
		name        string
		content     string
		shouldBlock bool
		description string
	}{
		{
			name:        "token_in_allowed_expression",
			content:     "${{ github.workflow }}/${{ secrets.TOKEN }}",
			shouldBlock: true,
			description: "Token in combined expression should be blocked",
		},
		{
			name:        "token_with_function_wrapper",
			content:     "${{ toJson(secrets.TOKEN) }}",
			shouldBlock: true,
			description: "Token wrapped in function should be blocked",
		},
		{
			name:        "token_in_conditional",
			content:     "${{ secrets.TOKEN == '' && 'empty' || 'has-value' }}",
			shouldBlock: true,
			description: "Token in conditional should be blocked",
		},
		{
			name:        "token_with_string_concat",
			content:     "${{ 'prefix-' + secrets.TOKEN + '-suffix' }}",
			shouldBlock: true,
			description: "Token with string concatenation should be blocked",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			err := validateExpressionSafety(tt.content)

			if tt.shouldBlock && err == nil {
				t.Errorf("Security violation: %s - %s", tt.name, tt.description)
			}
		})
	}
}

// =============================================================================
// Safe Output System Tests