Aman-Mittal commented on PR #217: URL: https://github.com/apache/fineract-backoffice-ui/pull/217#issuecomment-5158331131
### Secret-scanner alert on `3d55313` — resolved A scanner flagged a "Generic High Entropy Secret" in my commit. It was **not a real credential**, but the finding was legitimate and worth removing rather than dismissing. **What it was.** A test fixture I added to `auth.interceptor.spec.ts`: ```ts const token = 'dGVzdDp0b2tlbg=='; // base64 of "test:token" ``` Base64-of-`user:pass` is exactly the shape of a Basic credential, so a scanner has no way to tell it from the real thing — and neither does a reviewer skimming the diff. That is the scanner working correctly. **What I changed.** ```ts // Deliberately not base64-shaped. A realistic-looking encoded credential here trips secret // scanners, and the assertions only care that the header echoes whatever the service returned. const token = 'fake-token-for-tests'; ``` The tests only assert the header echoes whatever `getAuthToken()` returned, so the encoding was never doing any work. **Remediation.** I amended rather than adding a follow-up commit, and force-pushed (`3d55313` → `e987d7e`), so the string is gone from this branch's history rather than merely corrected at the tip. Verified with `git log -S` and a grep across every commit in the branch — both return zero. I also checked the rest of the branch for anything else base64-shaped that I introduced: none. 766 unit tests still pass and lint is clean. **Please re-run the scanner against `e987d7e`.** Worth noting for the repo generally: `base64EncodedAuthenticationKey: 'YmFzZTY0'` appears in several pre-existing mocked e2e specs. Those pre-date this branch and I have not touched them, but they are the same shape and may trip the same rule in future. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
