27 lines
800 B
Python
27 lines
800 B
Python
from __future__ import annotations
|
|
|
|
import subprocess
|
|
import sys
|
|
|
|
|
|
def test_leakage_scan_rejects_canary_and_accepts_clean_file(tmp_path) -> None:
|
|
path = tmp_path / "output.txt"
|
|
path.write_text("safe output", encoding="utf-8")
|
|
clean = subprocess.run(
|
|
[sys.executable, "tools/leakage_scan.py", "--canary", "secret-canary", str(path)],
|
|
capture_output=True,
|
|
text=True,
|
|
check=False,
|
|
)
|
|
assert clean.returncode == 0
|
|
|
|
path.write_text("oops secret-canary escaped", encoding="utf-8")
|
|
leaked = subprocess.run(
|
|
[sys.executable, "tools/leakage_scan.py", "--canary", "secret-canary", str(path)],
|
|
capture_output=True,
|
|
text=True,
|
|
check=False,
|
|
)
|
|
assert leaked.returncode == 1
|
|
assert "output.txt" in leaked.stdout
|