funman300
8cba70dc90
- Add 8 files present in docker/fifa17-python/tools but missing from the top-level tree: fut_accounts.py + 7 test_*.py contracts (all committed in the server's docker tree; byte-identical to the running image). - Preserve newer responder work already matching the running container: utas_server.py (offlineSeason), lsx_responder_v2.py (OPENFUT_BIND), blaze_responder_v3b.py, autopatch.py, pow_server.py, fut_store.py, test_fut_contract.py, fifa17-hook-m1.sh. - Add 30 newer ghidra_queries (draft purchase/state, SBC 9-26, runtime registries). Local tree is now a strict superset of B with all shared files byte-identical.
38 lines
1.2 KiB
Python
38 lines
1.2 KiB
Python
#!/usr/bin/env python3
|
|
"""Regression: ordinary UTAS diagnostics never expose session credentials."""
|
|
import importlib
|
|
import os
|
|
import sys
|
|
import tempfile
|
|
|
|
TOOLS = os.path.dirname(os.path.abspath(__file__))
|
|
if TOOLS not in sys.path:
|
|
sys.path.insert(0, TOOLS)
|
|
|
|
CANARY = "OPENFUT_UTAS_CANARY_SECRET"
|
|
|
|
|
|
def main():
|
|
with tempfile.TemporaryDirectory() as state:
|
|
os.environ["FUT_ACCOUNT_PATH"] = os.path.join(state, "active_account.json")
|
|
os.environ["FUT_PROFILE_ROOT"] = os.path.join(state, "accounts")
|
|
os.environ["FUT_LOG"] = os.path.join(state, "utas.log")
|
|
os.environ.pop("FUT_PROFILE", None)
|
|
|
|
import utas_server
|
|
importlib.reload(utas_server)
|
|
|
|
for name in ("X-UT-SID", "Authorization", "Cookie", "Set-Cookie"):
|
|
rendered = utas_server.safe_header_for_log(name, CANARY)
|
|
assert rendered == "[REDACTED]", (name, rendered)
|
|
assert CANARY not in rendered
|
|
|
|
assert utas_server.safe_header_for_log("Content-Type", "application/json") == "application/json"
|
|
assert utas_server.safe_header_for_log("X-Request-Id", "status-0") == "status-0"
|
|
|
|
print("UTAS header redaction: PASS")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|