You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "alnzng (via GitHub)" <gi...@apache.org> on 2026/09/13 08:40:37 UTC
[PR] [python] Use a reserved host in the redirect user-info test fixture [flink-agents]
alnzng opened a new pull request, #1115:
URL: https://github.com/apache/flink-agents/pull/1115
### Purpose of change
`test_rejects_redirect_user_info_without_leaking_secrets` builds its redirect `Location` from the live test server address:
```python
target = base_url.removeprefix("http://")
f"http://user:password@{target}/skills.zip?token=top-secret"
```
Putting `user:password` on a live host is an anti-pattern — RFC 3986 §3.2.1 deprecates the format — and many organizations run secret-scanning rules that detect it. LinkedIn is one of them, and that makes this commit unpushable to our internal GitHub: the push is blocked on exactly this line.
```
—— uri_secrets ——————————————————————————————
locations:
- commit: 0148970c7bd7f9c33f8897b878dde7ad059e91b6
path: python/flink_agents/runtime/skill/tests/test_materialize.py:235
```
Because the line is in committed history, it cannot be fixed downstream. Using the reserved `example.com` (RFC 2606) keeps the credential unambiguously synthetic, which is what the other 14 credential-bearing fixtures in this repo already do — none of them were flagged in the same push.
### Tests
No new tests; this changes a fixture value in an existing test.
The live address is not needed. `_SameProtocolRedirectHandler.redirect_request()` validates the target before delegating to the base handler, so the `ValueError` is raised before the redirect is followed and the host is never contacted. Redirect validation compares schemes only, never hosts, so the same code path is exercised. This matches `test_rejects_cross_protocol_redirect_before_request`, which hardcodes `https://127.0.0.1:1` for the same reason.
The test still asserts the same `ValueError` matching `"must not include user info"`, and that neither `"password"` nor `"top-secret"` reaches the message.
All 18 tests in `test_materialize.py` pass. `ruff check` and `ruff format --check` are clean.
### API
No public API change.
### Documentation
- [ ] `doc-needed`
- [x] `doc-not-needed`
- [ ] `doc-included`
### Was this patch authored or co-authored using generative AI tooling?
- [x] Yes
- [ ] No
Generated-by: Claude Code 2.1.265 (Claude Opus 5)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [python] Use a reserved host in the redirect user-info test fixture [flink-agents]
Posted by "wenjin272 (via GitHub)" <gi...@apache.org>.
wenjin272 merged PR #1115:
URL: https://github.com/apache/flink-agents/pull/1115
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org