Skip to content

Commit c9a9b94

Browse files
wtgodbewtgodbe
authored
Resolve remaining credscan bugs (#31157)
1 parent 28a6f89 commit c9a9b94

File tree

4 files changed

+128
-28
lines changed

4 files changed

+128
-28
lines changed

‎.config/CredScanSuppressions.json

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
{
22
"tool": "Credential Scanner",
33
"suppressions": [
4+
{
5+
"placeholder": "aspnetcore",
6+
"_justification": "This is a fake password used in test code."
7+
},
48
{
59
"placeholder": "password",
610
"_justification": "This is a fake password used in test code."
@@ -25,6 +29,98 @@
2529
"file": "\\src\\Servers\\Kestrel\\shared\\test\\TestCertificates\\testCert.pfx",
2630
"_justification": "Legitimate UT certificate file with private key"
2731
},
32+
{
33+
"file": "\\src\\DataProtection\\DataProtection\\test\\TestFiles\\TestCert1.pfx",
34+
"_justification": "Legitimate UT certificate file with private key"
35+
},
36+
{
37+
"file": "\\src\\DataProtection\\DataProtection\\test\\TestFiles\\TestCert2.pfx",
38+
"_justification": "Legitimate UT certificate file with private key"
39+
},
40+
{
41+
"file": "\\src\\DataProtection\\Extensions\\test\\TestFiles\\TestCert.pfx",
42+
"_justification": "Legitimate UT certificate file with private key"
43+
},
44+
{
45+
"file": "\\src\\DataProtection\\Extensions\\test\\TestFiles\\TestCert2.pfx",
46+
"_justification": "Legitimate UT certificate file with private key"
47+
},
48+
{
49+
"file": "\\src\\DataProtection\\Extensions\\test\\TestFiles\\TestCert3.pfx",
50+
"_justification": "Legitimate UT certificate file with private key"
51+
},
52+
{
53+
"file": "\\src\\DataProtection\\Extensions\\test\\TestFiles\\TestCert3WithoutPrivateKey.pfx",
54+
"_justification": "Legitimate UT certificate file without private key"
55+
},
56+
{
57+
"file": "\\src\\DataProtection\\Extensions\\test\\TestFiles\\TestCertWithoutPrivateKey.pfx",
58+
"_justification": "Legitimate UT certificate file without private key"
59+
},
60+
{
61+
"file": "\\src\\DefaultBuilder\\test\\Microsoft.AspNetCore.FunctionalTests\\testCert.pfx",
62+
"_justification": "Legitimate UT certificate file with private key"
63+
},
64+
{
65+
"file": "\\src\\Identity\\ApiAuthorization.IdentityServer\\test\\current.pfx",
66+
"_justification": "Legitimate UT certificate file with private key"
67+
},
68+
{
69+
"file": "\\src\\Identity\\ApiAuthorization.IdentityServer\\test\\expired.pfx",
70+
"_justification": "Legitimate UT certificate file with private key"
71+
},
72+
{
73+
"file": "\\src\\Identity\\ApiAuthorization.IdentityServer\\test\\future.pfx",
74+
"_justification": "Legitimate UT certificate file with private key"
75+
},
76+
{
77+
"file": "\\src\\Identity\\ApiAuthorization.IdentityServer\\test\\test.pfx",
78+
"_justification": "Legitimate UT certificate file with private key"
79+
},
80+
{
81+
"file": "\\src\\Middleware\\WebSockets\\test\\ConformanceTests\\AutobahnTestApp\\TestResources\\testCert.pfx",
82+
"_justification": "Legitimate UT certificate file with private key"
83+
},
84+
{
85+
"file": "\\src\\Security\\Authentication\\Negotiate\\test\\Negotiate.FunctionalTest\\negotiateAuthCert.pfx",
86+
"_justification": "Legitimate UT certificate file with private key"
87+
},
88+
{
89+
"file": "\\src\\Servers\\IIS\\tools\\TestCert.pfx",
90+
"_justification": "Legitimate UT certificate file with private key"
91+
},
92+
{
93+
"file": "\\src\\Servers\\Kestrel\\shared\\test\\TestCertificates\\aspnetdevcert.pfx",
94+
"_justification": "Legitimate UT certificate file with private key"
95+
},
96+
{
97+
"file": "\\src\\Servers\\Kestrel\\shared\\test\\TestCertificates\\eku.client.pfx",
98+
"_justification": "Legitimate UT certificate file with private key"
99+
},
100+
{
101+
"file": "\\src\\Servers\\Kestrel\\shared\\test\\TestCertificates\\eku.code_signing.pfx",
102+
"_justification": "Legitimate UT certificate file with private key"
103+
},
104+
{
105+
"file": "\\src\\Servers\\Kestrel\\shared\\test\\TestCertificates\\eku.multiple_usages.pfx",
106+
"_justification": "Legitimate UT certificate file with private key"
107+
},
108+
{
109+
"file": "\\src\\Servers\\Kestrel\\shared\\test\\TestCertificates\\eku.server.pfx",
110+
"_justification": "Legitimate UT certificate file with private key"
111+
},
112+
{
113+
"file": "\\src\\Servers\\Kestrel\\shared\\test\\TestCertificates\\no_extensions.pfx",
114+
"_justification": "Legitimate UT certificate file with private key"
115+
},
116+
{
117+
"file": "\\src\\SignalR\\clients\\ts\\FunctionalTests\\testCert.pfx",
118+
"_justification": "Legitimate UT certificate file with private key"
119+
},
120+
{
121+
"file": "\\src\\SignalR\\clients\\ts\\FunctionalTests\\testCertECC.pfx",
122+
"_justification": "Legitimate UT certificate file with private key"
123+
},
28124
{
29125
"file": "\\src\\Servers\\Kestrel\\shared\\test\\TestCertificates\\https-aspnet.key",
30126
"_justification": "Legitimate key file used for testing"
@@ -52,6 +148,10 @@
52148
{
53149
"file": "\\src\\Servers\\Kestrel\\shared\\test\\TestCertificates\\https-rsa.key",
54150
"_justification": "Legitimate key file used for testing"
151+
},
152+
{
153+
"file": "\\src\\SignalR\\clients\\ts\\FunctionalTests\\node_modules\\https-proxy-agent\\node_modules\\agent-base\\test\\ssl-cert-snakeoil.key",
154+
"_justification": "Legitimate key file used for testing"
55155
}
56156
]
57157
}

‎src/Http/Headers/test/CacheControlHeaderValueTest.cs

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -115,21 +115,21 @@ public void ToString_UseResponseDirectiveValues_AllSerializedCorrectly()
115115

116116
cacheControl.NoCache = true;
117117
Assert.Equal("no-cache", cacheControl.ToString());
118-
cacheControl.NoCacheHeaders.Add("token1");
119-
Assert.Equal("no-cache=\"token1\"", cacheControl.ToString());
118+
cacheControl.NoCacheHeaders.Add("PLACEHOLDER1");
119+
Assert.Equal("no-cache=\"PLACEHOLDER1\"", cacheControl.ToString());
120120
cacheControl.Public = true;
121-
Assert.Equal("public, no-cache=\"token1\"", cacheControl.ToString());
121+
Assert.Equal("public, no-cache=\"PLACEHOLDER1\"", cacheControl.ToString());
122122

123123
cacheControl = new CacheControlHeaderValue();
124124
cacheControl.Private = true;
125125
Assert.Equal("private", cacheControl.ToString());
126-
cacheControl.PrivateHeaders.Add("token2");
127-
cacheControl.PrivateHeaders.Add("token3");
128-
Assert.Equal("private=\"token2, token3\"", cacheControl.ToString());
126+
cacheControl.PrivateHeaders.Add("PLACEHOLDER2");
127+
cacheControl.PrivateHeaders.Add("PLACEHOLDER3");
128+
Assert.Equal("private=\"PLACEHOLDER2, PLACEHOLDER3\"", cacheControl.ToString());
129129
cacheControl.MustRevalidate = true;
130-
Assert.Equal("must-revalidate, private=\"token2, token3\"", cacheControl.ToString());
130+
Assert.Equal("must-revalidate, private=\"PLACEHOLDER2, PLACEHOLDER3\"", cacheControl.ToString());
131131
cacheControl.ProxyRevalidate = true;
132-
Assert.Equal("must-revalidate, proxy-revalidate, private=\"token2, token3\"", cacheControl.ToString());
132+
Assert.Equal("must-revalidate, proxy-revalidate, private=\"PLACEHOLDER2, PLACEHOLDER3\"", cacheControl.ToString());
133133
}
134134

135135
[Fact]
@@ -218,21 +218,21 @@ public void GetHashCode_CompareCollectionFieldsSet_MatchExpectation()
218218
var cacheControl5 = new CacheControlHeaderValue();
219219

220220
cacheControl1.NoCache = true;
221-
cacheControl1.NoCacheHeaders.Add("token2");
221+
cacheControl1.NoCacheHeaders.Add("PLACEHOLDER2");
222222

223223
cacheControl2.NoCache = true;
224-
cacheControl2.NoCacheHeaders.Add("token1");
225-
cacheControl2.NoCacheHeaders.Add("token2");
224+
cacheControl2.NoCacheHeaders.Add("PLACEHOLDER1");
225+
cacheControl2.NoCacheHeaders.Add("PLACEHOLDER2");
226226

227227
CompareHashCodes(cacheControl1, cacheControl2, false);
228228

229-
cacheControl1.NoCacheHeaders.Add("token1");
229+
cacheControl1.NoCacheHeaders.Add("PLACEHOLDER1");
230230
CompareHashCodes(cacheControl1, cacheControl2, true);
231231

232232
// Since NoCache and Private generate different hash codes, even if NoCacheHeaders and PrivateHeaders
233233
// have the same values, the hash code will be different.
234234
cacheControl3.Private = true;
235-
cacheControl3.PrivateHeaders.Add("token2");
235+
cacheControl3.PrivateHeaders.Add("PLACEHOLDER2");
236236
CompareHashCodes(cacheControl1, cacheControl3, false);
237237

238238

@@ -343,27 +343,27 @@ public void Equals_CompareCollectionFieldsSet_MatchExpectation()
343343
var cacheControl6 = new CacheControlHeaderValue();
344344

345345
cacheControl1.NoCache = true;
346-
cacheControl1.NoCacheHeaders.Add("token2");
346+
cacheControl1.NoCacheHeaders.Add("PLACEHOLDER2");
347347

348348
Assert.False(cacheControl1.Equals(null), "Compare with 'null'");
349349

350350
cacheControl2.NoCache = true;
351-
cacheControl2.NoCacheHeaders.Add("token1");
352-
cacheControl2.NoCacheHeaders.Add("token2");
351+
cacheControl2.NoCacheHeaders.Add("PLACEHOLDER1");
352+
cacheControl2.NoCacheHeaders.Add("PLACEHOLDER2");
353353

354354
CompareValues(cacheControl1!, cacheControl2, false);
355355

356-
cacheControl1!.NoCacheHeaders.Add("token1");
356+
cacheControl1!.NoCacheHeaders.Add("PLACEHOLDER1");
357357
CompareValues(cacheControl1, cacheControl2, true);
358358

359359
// Since NoCache and Private generate different hash codes, even if NoCacheHeaders and PrivateHeaders
360360
// have the same values, the hash code will be different.
361361
cacheControl3.Private = true;
362-
cacheControl3.PrivateHeaders.Add("token2");
362+
cacheControl3.PrivateHeaders.Add("PLACEHOLDER2");
363363
CompareValues(cacheControl1, cacheControl3, false);
364364

365365
cacheControl4.Private = true;
366-
cacheControl4.PrivateHeaders.Add("token3");
366+
cacheControl4.PrivateHeaders.Add("PLACEHOLDER3");
367367
CompareValues(cacheControl3, cacheControl4, false);
368368

369369
cacheControl5.Extensions.Add(new NameValueHeaderValue("custom"));
@@ -386,9 +386,9 @@ public void TryParse_DifferentValidScenarios_AllReturnTrue()
386386

387387
expected = new CacheControlHeaderValue();
388388
expected.NoCache = true;
389-
expected.NoCacheHeaders.Add("token1");
390-
expected.NoCacheHeaders.Add("token2");
391-
CheckValidTryParse("no-cache=\"token1, token2\"", expected);
389+
expected.NoCacheHeaders.Add("PLACEHOLDER1");
390+
expected.NoCacheHeaders.Add("PLACEHOLDER2");
391+
CheckValidTryParse("no-cache=\"PLACEHOLDER1, PLACEHOLDER2\"", expected);
392392

393393
expected = new CacheControlHeaderValue();
394394
expected.NoStore = true;
@@ -406,12 +406,12 @@ public void TryParse_DifferentValidScenarios_AllReturnTrue()
406406
expected = new CacheControlHeaderValue();
407407
expected.Public = true;
408408
expected.Private = true;
409-
expected.PrivateHeaders.Add("token1");
409+
expected.PrivateHeaders.Add("PLACEHOLDER1");
410410
expected.MustRevalidate = true;
411411
expected.ProxyRevalidate = true;
412412
expected.Extensions.Add(new NameValueHeaderValue("c", "d"));
413413
expected.Extensions.Add(new NameValueHeaderValue("a", "b"));
414-
CheckValidTryParse(",public, , private=\"token1\", must-revalidate, c=d, proxy-revalidate, a=b", expected);
414+
CheckValidTryParse(",public, , private=\"PLACEHOLDER1\", must-revalidate, c=d, proxy-revalidate, a=b", expected);
415415

416416
expected = new CacheControlHeaderValue();
417417
expected.Private = true;

‎src/Security/Authentication/test/FacebookTests.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ protected override void RegisterAuth(AuthenticationBuilder services, Action<Face
4141
protected override void ConfigureDefaults(FacebookOptions o)
4242
{
4343
o.AppId = "whatever";
44-
o.AppSecret = "whatever";
44+
o.AppSecret = "PLACEHOLDER";
4545
o.SignInScheme = "auth1";
4646
}
4747

@@ -50,7 +50,7 @@ public async Task ThrowsIfAppIdMissing()
5050
{
5151
using var host = await CreateHost(
5252
app => { },
53-
services => services.AddAuthentication().AddFacebook(o => o.SignInScheme = "Whatever"),
53+
services => services.AddAuthentication().AddFacebook(o => o.SignInScheme = "PLACEHOLDER"),
5454
async context =>
5555
{
5656
await Assert.ThrowsAsync<ArgumentException>("AppId", () => context.ChallengeAsync("Facebook"));

‎src/Security/Authentication/test/TwitterTests.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,8 @@ protected override void RegisterAuth(AuthenticationBuilder services, Action<Twit
3636

3737
protected override void ConfigureDefaults(TwitterOptions o)
3838
{
39-
o.ConsumerKey = "whatever";
40-
o.ConsumerSecret = "whatever";
39+
o.ConsumerKey = "PLACEHOLDER";
40+
o.ConsumerSecret = "PLACEHOLDER";
4141
o.SignInScheme = "auth1";
4242
}
4343

0 commit comments

Comments
 (0)