From 65539780e598db5f8da9faf76302c4a494af7104 Mon Sep 17 00:00:00 2001 From: mlsmaycon Date: Wed, 12 Aug 2026 10:36:39 +0000 Subject: [PATCH] [client] Assert the MDM upload URL never leaks into the debug bundle Populate DebugBundleUploadURL with a token-bearing value and assert the rendered bundle contains neither the field name nor the token, in both anonymize modes. The excluded-map entry only skips the missing-field check; this guards against the value being serialized by a future change. --- client/internal/debug/debug_test.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/client/internal/debug/debug_test.go b/client/internal/debug/debug_test.go index 5123ed68d..17d520358 100644 --- a/client/internal/debug/debug_test.go +++ b/client/internal/debug/debug_test.go @@ -888,6 +888,7 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) { ClientCertPath: "/tmp/cert", ClientCertKeyPath: "/tmp/key", LazyConnection: "on", + DebugBundleUploadURL: "https://upload.example.test/bundle?token=secret", MTU: 1280, DisableIPv6: true, SyncMessageVersion: func(v int) *int { return &v }(1), @@ -905,6 +906,13 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) { g.addCommonConfigFields(&sb) rendered := sb.String() + renderAddConfigSpecific(g) + // DebugBundleUploadURL is an MDM-provided value that can carry + // credentials or signed query tokens. It is deliberately excluded + // above; assert it never reaches the rendered bundle — neither the + // field name nor the token — in either anonymize mode. + assert.NotContains(t, rendered, "DebugBundleUploadURL:", "MDM upload URL field must not be serialized into the debug bundle") + assert.NotContains(t, rendered, "token=secret", "MDM upload URL value must not leak into the debug bundle") + val := reflect.ValueOf(cfg).Elem() typ := val.Type() var missing []string