This is an automated email from the ASF dual-hosted git repository. cgivre pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/drill-mcp.git
commit d660a67bc273c055850243e25b9a0bd5485e9370 Author: cgivre <[email protected]> AuthorDate: Wed Aug 12 16:26:56 2026 -0400 clarify: note why test_leaves_innocuous_keys_alone's input has no embedded credential --- tests/test_redact.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tests/test_redact.py b/tests/test_redact.py index f195a20..667d6bf 100644 --- a/tests/test_redact.py +++ b/tests/test_redact.py @@ -42,6 +42,11 @@ def test_redacts_all_sensitive_key_patterns(): def test_leaves_innocuous_keys_alone(): + # Deliberately no embedded credentials here (no "user:pass@" in the + # value) -- this is still a value redact() must leave alone. The case + # where a value under an innocuous key DOES carry a secret (userinfo, a + # password= query parameter) is covered separately below; that shape + # used to be left alone too, which was the bug. assert redact({"type": "file", "connection": "s3a://bucket"}) == { "type": "file", "connection": "s3a://bucket",
