Open
Conversation
## Summary Implements automated sanitization of Azure Storage SAS tokens in test recording files to prevent credential leaks. Also adds secret scanning to CI/CD pipeline and pre-commit hooks for prevention. ## Changes Made ### Security Fix (Critical) - Add SasTokenScrubber recording processor to automatically sanitize SAS token parameters (sig, se, sv, sp, sr, st, sip, spr) - Update PartnerCenterScenarioTest base class to apply scrubber to all test recordings automatically - Manually sanitize exposed SAS tokens in existing test recording file test_marketplace_offer_listing_media.yaml ### Prevention Measures - Add Gitleaks secret scanning to GitHub Actions CI/CD pipeline - Add pre-commit hook configuration for local secret detection - Create .gitleaksignore for managing false positives - Add SECURITY_TESTING.md documentation for secure testing practices - Update .gitignore to exclude IcM/MSRC documentation files ### Files Modified - partnercenter/azext_partnercenter/tests/base.py - Import SasTokenScrubber - Apply scrubber in __init__ method - partnercenter/azext_partnercenter/tests/latest/recordings/test_marketplace_offer_listing_media.yaml - Sanitized all SAS token parameters - Verified YAML syntax remains valid ### Files Added - partnercenter/azext_partnercenter/tests/recording_processors.py - SasTokenScrubber class implementation - .github/workflows/secret-scanning.yml - Automated Gitleaks scanning on PR and push - .pre-commit-config.yaml - Pre-commit hooks for local development - .gitleaksignore - Gitleaks ignore patterns - SECURITY_TESTING.md - Comprehensive security testing guide ### Files Modified - .gitignore - Exclude IcM_*.md, MSRC_*.md, and recording backups ## Context Addresses IcM #109741 (ticket 3100000562062) - Publicly exposed SAS tokens in test recording file. **Important Note:** The exposed SAS tokens were already expired (June 19, 2023) when they were committed to the repository (January 24, 2024), resulting in zero-day exposure window for active credentials. The storage account was associated with an Azure subscription that has since been decommissioned. Current risk assessment: LOW. This fix ensures future test recordings will have SAS tokens automatically sanitized, preventing similar issues. ## Testing - ✅ Validated YAML syntax of sanitized recording file - ✅ Confirmed all SAS parameters replaced with safe values - ✅ Verified no real signatures remain in recording - ✅ Reviewed scrubber regex patterns for comprehensive coverage -⚠️ Cannot run live tests (lost Azure subscription access) -⚠️ Cannot validate playback tests (no test environment available) ## Security Review - Tokens expired: June 19, 2023 (999 days ago) - Commit date: January 24, 2024 (7 months after expiration) - Exposure window: 0 days (no active credentials exposed) - Storage account: Likely decommissioned with subscription - Risk level: LOW ## Breaking Changes None. All changes are backward compatible. ## Additional Notes Due to loss of access to the original Azure subscription/marketplace account, test recordings could not be regenerated via live test runs. Manual sanitization was performed using regex patterns that match the automated scrubber implementation. --- Ref: IcM #109741 Ref: https://github.com/Azure/partnercenter-cli-extension/issues/<issue-number>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements comprehensive security measures to prevent accidental credential leaks in test recordings, specifically
focusing on sanitizing Azure Storage SAS tokens that can be exposed during test execution.
Changes
sensitive SAS token parameters (signature, expiry, version, permissions) in test recordings
all tests
main
file checks
procedures, and troubleshooting
Security Impact
This PR addresses the security risk identified in commit bf55de8 where expired SAS tokens were found in test
recordings. The implementation provides defense-in-depth:
Test Plan