Withhold secret-looking variables from the processes the runner starts

Workers and the other processes the runner starts copied its whole
environment, tokens and passwords included. ChildProcess::Start now
leaves out every variable whose name contains, in any case, TOKEN,
SECRET, PASSWORD, PASSWD, CREDENTIAL, API_KEY, APIKEY, PRIVATE_KEY or
ACCESS_KEY (IsSecretVariable), unless ChildOptions::keptEnvironment
names it; names compare without case on Windows.

--pass-env=NAME, repeatable, and "pass-env" in catch3.json keep a
variable for the tests. The runner itself still starts with the whole
environment, so code that runs before the first worker sees it;
docs/progmasoft-runner.md says so.

A runner test starts the shell's environment listing with a secret and
a plain variable set, sees only the plain one, and sees the secret once
it is kept.

1 files changed, 9 insertions, 0 deletions

diff --git a/src/Progmasoft/Runner/Process.hpp b/src/Progmasoft/Runner/Process.hpp
index 733bdbf7..3e0a1dd2 100644
--- a/src/Progmasoft/Runner/Process.hpp
+++ b/src/Progmasoft/Runner/Process.hpp
@@ -121,6 +121,9 @@ namespace Progmasoft::Catch3::Runner
         std::vector<std::string> arguments;
         /// Variables added to, or replacing, those of this process.
         std::vector<std::pair<std::string, std::string>> environment;
+        /// Variables of this process the child keeps although their names
+        /// look like secrets; see `IsSecretVariable`.
+        std::vector<std::string> keptEnvironment;
         /// The working directory; empty keeps the current one.
         std::filesystem::path workingDirectory;
         bool searchPath = false;
@@ -230,6 +233,12 @@ namespace Progmasoft::Catch3::Runner
     [[nodiscard]] unsigned
     HardwareThreads() noexcept;
 
+    /// Whether a variable of this name holds a secret that a child does not
+    /// inherit: its name contains, in any case, TOKEN, SECRET, PASSWORD,
+    /// PASSWD, CREDENTIAL, API_KEY, APIKEY, PRIVATE_KEY or ACCESS_KEY.
+    [[nodiscard]] bool
+    IsSecretVariable(std::string_view name);
+
     /// The value of an environment variable; empty when it is not set.
     [[nodiscard]] std::string
     ReadEnvironment(const char *name);