🚀 Big News: Socket Acquires Coana to Bring Reachability Analysis to Every Appsec Team.Learn more
Socket
DemoInstallSign in
Socket

pytest-mask-secrets

Package Overview
Dependencies
Maintainers
1
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

pytest-mask-secrets

Pytest plugin to hide sensitive data in test reports

1.4.0
PyPI
Maintainers
1

pytest-mask-secrets

pytest-mask-secrets is a plugin for pytest that removes sensitive data from test reports.

Based on the configuration, it searches for specified secrets, passwords, and tokens in the records and replaces them with asterisks.

While this feature is usually provided by CI tools, it can be insufficient in many situations as it only strips secrets from the captured output. A common case of leaking secrets is through generated JUnit files that are not curated by CI tools. Therefore, it is necessary to have such functionality at the pytest level.

Installation

pip install pytest-mask-secrets

Usage

pytest-mask-secrets needs to know which values to mask. These values are read from environment variables. The list of these variables is passed in the MASK_SECRETS environment variable, which contains a comma-separated list of all environment variables containing secrets. Here is an example:

export PYPI_API_TOKEN=mytoken
export SOME_PASSWORD=mypassword
export MASK_SECRETS=PYPI_API_TOKEN,SOME_PASSWORD

pytest

With pytest-mask-secrets installed, all occurrences of "mytoken" and "mypassword" will be eliminated from the report.

Define Secret Values in the Code

Tests can use config.stash to define secret values to be masked. There is a mask_secrets_key available that provides access to a set() where additional secret values can be added. Here is an example:

from pytest_mask_secrets.plugin import mask_secrets_key

def test(pytestconfig):
    pytestconfig.stash[mask_secrets_key].add("true-secret")
    ...

All occurrences of "true-secret" will be removed from the report.

Automagic Identification of Variables with Secrets

If MASK_SECRETS_AUTO is set to anything other than zero ("0"), all environment variables containing the words "TOKEN", "SECRET," "PASSWORD," or "PASSWD" in their names are considered sensitive, and their values are removed from the report.

This discovery mode should be used with caution. CI workflows, in particular, should rely on an explicit list of secret variables. Under certain circumstances, this method can lead to the leakage of other sensitive data (if, by accident, a secret from an environment variable matches text commonly present in the test report). Nevertheless, this method can still be useful for example for local execution to prevent accidental leaks through copy-and-paste.

FAQs

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts