Withhold secret-looking variables from the processes the runner starts

Workers and the other processes the runner starts copied its whole
environment, tokens and passwords included. ChildProcess::Start now
leaves out every variable whose name contains, in any case, TOKEN,
SECRET, PASSWORD, PASSWD, CREDENTIAL, API_KEY, APIKEY, PRIVATE_KEY or
ACCESS_KEY (IsSecretVariable), unless ChildOptions::keptEnvironment
names it; names compare without case on Windows.

--pass-env=NAME, repeatable, and "pass-env" in catch3.json keep a
variable for the tests. The runner itself still starts with the whole
environment, so code that runs before the first worker sees it;
docs/progmasoft-runner.md says so.

A runner test starts the shell's environment listing with a secret and
a plain variable set, sees only the plain one, and sees the secret once
it is kept.

1 files changed, 40 insertions, 0 deletions

diff --git a/tests/Progmasoft/Runner.tests.cpp b/tests/Progmasoft/Runner.tests.cpp
index 7b7d032e..66586f77 100644
--- a/tests/Progmasoft/Runner.tests.cpp
+++ b/tests/Progmasoft/Runner.tests.cpp
@@ -292,3 +292,43 @@ TEST_CASE("JUnit and trace outputs are written", "[progmasoft][runner]")
     REQUIRE(traceJson);
     CHECK((*traceJson)["traceEvents"].Items().size() >= 3);
 }
+
+TEST_CASE("A child does not inherit the secrets of the runner",
+          "[progmasoft][runner]")
+{
+    CHECK(Runner::IsSecretVariable("GITHUB_TOKEN"));
+    CHECK(Runner::IsSecretVariable("aws_secret_access_key"));
+    CHECK(Runner::IsSecretVariable("DB_PASSWORD"));
+    CHECK(Runner::IsSecretVariable("NPM_ApiKey"));
+    CHECK_FALSE(Runner::IsSecretVariable("PATH"));
+    CHECK_FALSE(Runner::IsSecretVariable("XAUTHORITY"));
+
+    Runner::ChildOptions options;
+#if defined(_WIN32)
+    REQUIRE(_putenv_s("CATCH3_TEST_TOKEN", "withheld") == 0);
+    REQUIRE(_putenv_s("CATCH3_TEST_PLAIN", "kept") == 0);
+    options.arguments = { "cmd.exe", "/d", "/c", "set" };
+#else
+    REQUIRE(setenv("CATCH3_TEST_TOKEN", "withheld", 1) == 0);
+    REQUIRE(setenv("CATCH3_TEST_PLAIN", "kept", 1) == 0);
+    options.arguments = { "env" };
+#endif
+    options.searchPath = true;
+    auto printed = Runner::RunAndCapture(options);
+    REQUIRE(printed);
+    CHECK(printed->output.find("CATCH3_TEST_TOKEN") == std::string::npos);
+    CHECK_THAT(printed->output, ContainsSubstring("CATCH3_TEST_PLAIN=kept"));
+
+    options.keptEnvironment = { "CATCH3_TEST_TOKEN" };
+    printed = Runner::RunAndCapture(options);
+    REQUIRE(printed);
+    CHECK_THAT(printed->output,
+               ContainsSubstring("CATCH3_TEST_TOKEN=withheld"));
+#if defined(_WIN32)
+    CHECK(_putenv_s("CATCH3_TEST_TOKEN", "") == 0);
+    CHECK(_putenv_s("CATCH3_TEST_PLAIN", "") == 0);
+#else
+    CHECK(unsetenv("CATCH3_TEST_TOKEN") == 0);
+    CHECK(unsetenv("CATCH3_TEST_PLAIN") == 0);
+#endif
+}