From 6f981a559814b7c556c942fc6bc26250240e6d04 Mon Sep 17 00:00:00 2001 From: Alex Date: Thu, 17 Sep 2026 13:19:34 +0100 Subject: [PATCH] test: compare against the sanitiser, not a host substring CodeQL flags "host" in message as incomplete URL sanitisation. I removed that shape from two assertions and introduced a third in the same commit; this takes it out of the provider test and the remaining Redis one, comparing with what _endpoint produced instead, which is the contract those tests actually mean. --- tests/deploy/test_doctor.py | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/tests/deploy/test_doctor.py b/tests/deploy/test_doctor.py index 252af2fa..eb085038 100644 --- a/tests/deploy/test_doctor.py +++ b/tests/deploy/test_doctor.py @@ -243,14 +243,14 @@ class TestChecks: def test_a_provider_base_url_is_printed_without_its_credentials(self): """An OpenAI-compatible endpoint can carry userinfo, and doctor prints its detail.""" - check = commands._check_provider( - {"LLM_PROVIDER": "openai", "API_KEY": "x", - "OPENAI_BASE_URL": "https://someone:sEcReTtOkEn@models.example.com/v1"} - ) + url = "https://someone:sEcReTtOkEn@models.example.com/v1" + check = commands._check_provider({"LLM_PROVIDER": "openai", "API_KEY": "x", "OPENAI_BASE_URL": url}) assert check.level == "ok" assert "sEcReTtOkEn" not in check.detail assert "someone" not in check.detail - assert "models.example.com" in check.detail + # Compared with what the sanitiser produced rather than a host substring, which is both the + # real contract and the pattern CodeQL warns about. + assert check.detail == f"openai at {commands._endpoint(url)}" def test_services_are_named_for_the_install(self, tmp_path): names = _names(tmp_path) @@ -394,9 +394,10 @@ class TestRedisCheck: return Client() monkeypatch.setattr(redis.Redis, "from_url", classmethod(from_url)) - check = commands._check_redis({"cache": "redis://localhost:6379/2"}) + url = "redis://localhost:6379/2" + check = commands._check_redis({"cache": url}) assert check.level == "fail" - assert "cache" in check.detail and "6379/2" in check.detail + assert check.detail.startswith(f"cache ({commands._endpoint(url)}) does not answer") def test_a_password_in_the_url_is_never_printed(self, monkeypatch): """doctor output goes into terminals, CI logs and pasted issue reports."""