From d0e705bb25959c53b9233502e0524e3266b7067f Mon Sep 17 00:00:00 2001 From: Viktor Liu Date: Tue, 22 Sep 2026 21:06:07 +0200 Subject: [PATCH] Make the agent token-leak assertion able to fail --- client/vnc/server/agent_handshake_test.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/client/vnc/server/agent_handshake_test.go b/client/vnc/server/agent_handshake_test.go index 33677e2cc..5ab2248fd 100644 --- a/client/vnc/server/agent_handshake_test.go +++ b/client/vnc/server/agent_handshake_test.go @@ -91,7 +91,10 @@ func TestAgentHandshake_TokenNeverSent(t *testing.T) { }() require.NoError(t, agentClientHandshake(daemonSide, token, false)) - assert.NotContains(t, sent.Bytes(), token, "the token must not cross the socket") + // bytes.Contains, not assert.NotContains: testify compares a []byte + // haystack element-wise, and a []byte is never an element of a []byte, so + // the assertion held whatever crossed the wire — including the whole token. + assert.False(t, bytes.Contains(sent.Bytes(), token), "the token must not cross the socket") } // A tag is bound to the nonce it answered, so replaying one against a fresh