fix(security): redact Plex Home PIN from logs

2026-07-02 11:41:25 +02:00
parent 72d37f2362
commit bfcd11538e
2 changed files with 21 additions and 0 deletions
@@ -60,6 +60,21 @@ void main() {
      expect(result.contains('Authenticated=false'), isTrue);
    });

+    test('redacts Plex Home pin query parameter without registration', () {
+      final input = 'POST https://clients.plex.tv/api/v2/home/users/uuid/switch?X-Plex-Token=tok&pin=1234 → 201';
+      final result = LogRedactionManager.redact(input);
+      expect(result.contains('pin=1234'), isFalse);
+      expect(result.contains('pin=[REDACTED]'), isTrue);
+    });
+
+    test('pin redaction is case-insensitive and leaves compound params intact', () {
+      final result = LogRedactionManager.redact('PIN=0000&checkPin=abc&next=1');
+      expect(result.contains('PIN=0000'), isFalse);
+      expect(result.contains('pin=[REDACTED]'), isTrue);
+      expect(result.contains('checkPin=abc'), isTrue);
+      expect(result.contains('next=1'), isTrue);
+    });
+
    test('redacts X-Emby-Token header form', () {
      final result = LogRedactionManager.redact('X-Emby-Token: emby-secret');
      expect(result.contains('emby-secret'), isFalse);