alnzng opened a new pull request, #1115:
URL: https://github.com/apache/flink-agents/pull/1115
### Purpose of change
`test_rejects_redirect_user_info_without_leaking_secrets` builds its
redirect `Location` from the live test server address:
```python
target = base_url.removeprefix("http://";)
f"http://user:password@{target}/skills.zip?token=top-secret";
```
Putting `user:password` on a live host is an anti-pattern — RFC 3986 §3.2.1
deprecates the format — and many organizations run secret-scanning rules that
detect it. LinkedIn is one of them, and that makes this commit unpushable to
our internal GitHub: the push is blocked on exactly this line.
```
—— uri_secrets ——————————————————————————————
locations:
- commit: 0148970c7bd7f9c33f8897b878dde7ad059e91b6
path: python/flink_agents/runtime/skill/tests/test_materialize.py:235
```
Because the line is in committed history, it cannot be fixed downstream.
Using the reserved `example.com` (RFC 2606) keeps the credential unambiguously
synthetic, which is what the other 14 credential-bearing fixtures in this repo
already do — none of them were flagged in the same push.
### Tests
No new tests; this changes a fixture value in an existing test.
The live address is not needed.
`_SameProtocolRedirectHandler.redirect_request()` validates the target before
delegating to the base handler, so the `ValueError` is raised before the
redirect is followed and the host is never contacted. Redirect validation
compares schemes only, never hosts, so the same code path is exercised. This
matches `test_rejects_cross_protocol_redirect_before_request`, which hardcodes
`https://127.0.0.1:1` for the same reason.
The test still asserts the same `ValueError` matching `"must not include
user info"`, and that neither `"password"` nor `"top-secret"` reaches the
message.
All 18 tests in `test_materialize.py` pass. `ruff check` and `ruff format
--check` are clean.
### API
No public API change.
### Documentation
- [ ] `doc-needed`
- [x] `doc-not-needed`
- [ ] `doc-included`
### Was this patch authored or co-authored using generative AI tooling?
- [x] Yes
- [ ] No
Generated-by: Claude Code 2.1.265 (Claude Opus 5)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
