123 lines
4.7 KiB
JavaScript
123 lines
4.7 KiB
JavaScript
// Copyright (c) 2026 Gordon Bolton. MIT License.
|
|
/**
|
|
* Tests for server/utils/sanitizeError.js
|
|
*
|
|
* Critical security tests: verify that API keys, tokens, passwords and other
|
|
* secrets are NEVER leaked in error messages returned to clients or written
|
|
* to logs. Every pattern here represents a real credential type used in the
|
|
* sofarr stack (SABnzbd apikey, Emby tokens, qBittorrent basic-auth URLs).
|
|
*/
|
|
|
|
import sanitizeError from '../../server/utils/sanitizeError.js';
|
|
|
|
describe('sanitizeError', () => {
|
|
describe('query-param secrets', () => {
|
|
it('redacts ?apikey= values', () => {
|
|
const err = new Error('Request failed: https://sabnzbd.local/api?apikey=abc123secret&output=json');
|
|
expect(sanitizeError(err)).toContain('[REDACTED]');
|
|
expect(sanitizeError(err)).not.toContain('abc123secret');
|
|
});
|
|
|
|
it('redacts &apikey= mid-URL', () => {
|
|
const err = new Error('GET https://host/path?mode=queue&apikey=SUPERSECRET&output=json');
|
|
expect(sanitizeError(err)).not.toContain('SUPERSECRET');
|
|
expect(sanitizeError(err)).toContain('[REDACTED]');
|
|
});
|
|
|
|
it('redacts ?token= values', () => {
|
|
const err = new Error('https://api.example.com/data?token=tok_private99');
|
|
expect(sanitizeError(err)).not.toContain('tok_private99');
|
|
});
|
|
|
|
it('redacts ?password= values', () => {
|
|
const err = new Error('Auth failed: https://service.local?password=hunter2');
|
|
expect(sanitizeError(err)).not.toContain('hunter2');
|
|
});
|
|
|
|
it('redacts ?api_key= values', () => {
|
|
const err = new Error('https://sonarr.local/api/v3/series?api_key=e583d270f89846478e42');
|
|
expect(sanitizeError(err)).not.toContain('e583d270f89846478e42');
|
|
});
|
|
|
|
it('preserves non-secret query params', () => {
|
|
const result = sanitizeError(new Error('GET /api?mode=queue&output=json'));
|
|
expect(result).toContain('mode=queue');
|
|
expect(result).toContain('output=json');
|
|
});
|
|
});
|
|
|
|
describe('HTTP auth headers', () => {
|
|
it('redacts X-Api-Key header values', () => {
|
|
const err = new Error('Request: x-api-key: e583d270f89846478e42dd3cf90bfb00');
|
|
expect(sanitizeError(err)).not.toContain('e583d270f89846478e42dd3cf90bfb00');
|
|
expect(sanitizeError(err)).toContain('[REDACTED]');
|
|
});
|
|
|
|
it('redacts X-MediaBrowser-Token header values', () => {
|
|
const err = new Error('x-mediabrowser-token: b862f3a43f4c417285043a11aa28b1f7');
|
|
expect(sanitizeError(err)).not.toContain('b862f3a43f4c417285043a11aa28b1f7');
|
|
});
|
|
|
|
it('redacts Authorization header values', () => {
|
|
const err = new Error('authorization: MediaBrowser Token="abc123", DeviceId="xyz"');
|
|
expect(sanitizeError(err)).not.toContain('abc123');
|
|
});
|
|
});
|
|
|
|
describe('bearer tokens', () => {
|
|
it('redacts Bearer token values', () => {
|
|
const err = new Error('Error: bearer eyJhbGciOiJIUzI1NiJ9.payload.sig');
|
|
expect(sanitizeError(err)).not.toContain('eyJhbGciOiJIUzI1NiJ9');
|
|
expect(sanitizeError(err)).toContain('bearer [REDACTED]');
|
|
});
|
|
|
|
it('is case-insensitive for BEARER', () => {
|
|
const err = new Error('BEARER TOKEN_VALUE_HERE');
|
|
expect(sanitizeError(err)).not.toContain('TOKEN_VALUE_HERE');
|
|
});
|
|
});
|
|
|
|
describe('basic-auth URLs', () => {
|
|
it('redacts user:pass@ in URLs', () => {
|
|
const err = new Error('GET http://admin:b053288369XX!@qbittorrent.local/api');
|
|
expect(sanitizeError(err)).not.toContain('b053288369XX!');
|
|
expect(sanitizeError(err)).not.toContain('admin:');
|
|
expect(sanitizeError(err)).toContain('//[REDACTED]@');
|
|
});
|
|
|
|
it('handles https:// basic auth', () => {
|
|
const err = new Error('https://user:s3cr3t@service.local/path');
|
|
expect(sanitizeError(err)).not.toContain('s3cr3t');
|
|
});
|
|
});
|
|
|
|
describe('edge cases', () => {
|
|
it('handles non-Error input (plain string)', () => {
|
|
const result = sanitizeError('plain string error');
|
|
expect(typeof result).toBe('string');
|
|
});
|
|
|
|
it('handles null gracefully', () => {
|
|
expect(() => sanitizeError(null)).not.toThrow();
|
|
});
|
|
|
|
it('handles undefined gracefully', () => {
|
|
expect(() => sanitizeError(undefined)).not.toThrow();
|
|
});
|
|
|
|
it('preserves non-sensitive error messages unchanged', () => {
|
|
const err = new Error('Connection refused: ECONNREFUSED 127.0.0.1:8080');
|
|
const result = sanitizeError(err);
|
|
expect(result).toContain('ECONNREFUSED');
|
|
expect(result).toContain('127.0.0.1:8080');
|
|
});
|
|
|
|
it('does not leak stack traces (returns message only)', () => {
|
|
const err = new Error('something went wrong');
|
|
const result = sanitizeError(err);
|
|
expect(result).not.toContain('at ');
|
|
expect(result).not.toContain('.js:');
|
|
});
|
|
});
|
|
});
|