From 3cb53d3be14fb5248c969ad52d2e676d21316f6b Mon Sep 17 00:00:00 2001 From: Derek Date: Wed, 11 Nov 2026 09:55:33 +1100 Subject: [PATCH] test(secrets): assert the Azure vault URL field in repr() CodeQL flags the hostname substring check in repr() as incomplete URL sanitisation. The test checks that repr() shows vault_url as set. The check leaves CodeQL no hostname literal to flag. --- tests/unit/test_secrets_config_repr.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/unit/test_secrets_config_repr.py b/tests/unit/test_secrets_config_repr.py index 75d2a2b1..4ca74cc1 100644 --- a/tests/unit/test_secrets_config_repr.py +++ b/tests/unit/test_secrets_config_repr.py @@ -42,8 +42,8 @@ def test_aws_config_secret_access_key_redacted(): def test_azure_config_client_secret_redacted(): cfg = AzureConfig(vault_url="https://kv.azure.net/", client_secret=SECRET) assert SECRET not in repr(cfg) - # Substring check on repr() output, not a host allow-list. - assert "kv.azure.net" in repr(cfg) + # The vault URL is not a credential, so the repr still shows it. + assert f"vault_url={cfg.vault_url!r}" in repr(cfg) def test_gcp_config_unchanged():