Merge pull request #221 from contentstack/release/snyk-test-fixes

DX | 02-11-2026 | Release

Author: reeshika-h

Contentstack.Management.Core.Tests/Helpers/TestSecrets.cs

@@ -0,0 +1,39 @@
+using System;
+using System.Linq;
+using System.Security.Cryptography;
+
+namespace Contentstack.Management.Core.Tests.Helpers
+{
+    /// <summary>
+    /// Per-run generated values for tests that need credential-shaped inputs but must not
+    /// commit literal secrets. None of these are real credentials.
+    /// </summary>
+    internal static class TestSecrets
+    {
+        private const string Base32Alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+
+        public static string Password => Guid.NewGuid().ToString("N");
+
+        public static string Username => "user-" + Guid.NewGuid().ToString("N").Substring(0, 12) + "@example.com";
+
+        public static string Token() => Guid.NewGuid().ToString("N");
+
+        /// <summary>A stack API key-shaped value (blt + hex) that does not exist on any stack.</summary>
+        public static string BltKey() => "blt" + Guid.NewGuid().ToString("N").Substring(0, 16);
+
+        /// <summary>A valid RFC 4648 base32 string, suitable as a TOTP secret.</summary>
+        public static string Base32Secret()
+        {
+            var bytes = new byte[10];
+            RandomNumberGenerator.Fill(bytes);
+            return new string(bytes.Select(b => Base32Alphabet[b % 32]).ToArray());
+        }
+
+        /// <summary>A string that is not valid base32 (contains characters outside the alphabet).</summary>
+        public static string InvalidBase32Secret() => "!@#" + Guid.NewGuid().ToString("N");
+
+        /// <summary>Alternates upper/lower case; used to check case-insensitive secret handling.</summary>
+        public static string MixedCase(string value) =>
+            new string(value.Select((c, i) => i % 2 == 0 ? char.ToUpperInvariant(c) : char.ToLowerInvariant(c)).ToArray());
+    }
+}

Contentstack.Management.Core.Tests/IntegrationTest/Contentstack001_LoginTest.cs

@@ -388,13 +388,9 @@ public async System.Threading.Tasks.Task Test013_Stack_Settings_Async()
         #region Negative and error-handling tests (Test014+)
 
         /// <summary>Non-empty API key used only to exercise SDK preconditions without requiring Test003 to succeed.</summary>
-        // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
-        // deepcode ignore NoHardcodedCredentials: test fixture value, not a real secret
-        private const string SdkNonEmptyApiKey = "bltSdkValidationNonEmptyApiKey00";
+        private static readonly string SdkNonEmptyApiKey = TestSecrets.BltKey();
 
-        // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
-        // deepcode ignore NoHardcodedCredentials: test fixture value, not a real secret
-        private const string InvalidStackApiKey = "bltNonExistentStackKey12345";
+        private static readonly string InvalidStackApiKey = TestSecrets.BltKey();
 
         private static void AssertStackApiKeyOrInconclusive()
         {
@@ -1002,7 +998,6 @@ public void Test056_Should_Fail_UpdateUserRole_Invalid_User_Uid_API()
             {
                 new UserInvitation
                 {
-                    // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                     Uid = "blt_fake_user_uid_99999",
                     Roles = new List<string> { "blt_fake_role_uid_99999" }
                 }
@@ -1027,7 +1022,6 @@ public async Task Test057_Should_Fail_UpdateUserRoleAsync_Invalid_Role_Uid_API()
             {
                 new UserInvitation
                 {
-                    // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                     Uid = "blt_fake_user_uid_88888",
                     Roles = new List<string> { "blt_fake_role_uid_88888" }
                 }

Contentstack.Management.Core.Tests/IntegrationTest/Contentstack003_StackTest.cs

@@ -204,9 +204,7 @@ public async System.Threading.Tasks.Task Test009_Should_Delete_Async_Global_Fiel
 
         #region Constants
         private const string InvalidGlobalFieldUid = "non_existent_global_field_uid_12345";
-        // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
-        // deepcode ignore NoHardcodedCredentials: test fixture value, not a real secret
-        private const string InvalidApiKey = "bltInvalidApiKey12345";
+        private static readonly string InvalidApiKey = TestSecrets.BltKey();
         private static readonly string VeryLongTitle = new string('a', 300); // 300 characters
         private const string SqlInjectionTitle = "'; DROP TABLE global_fields; --";
         private const string XssTitle = "<script>alert('xss')</script>";

Contentstack.Management.Core.Tests/IntegrationTest/Contentstack011_GlobalFieldTest.cs

@@ -2358,7 +2358,6 @@ public async Task Test060_Should_Fail_With_Expired_Auth_Token_For_Asset_Operatio
             var expiredTokenClient = new ContentstackClient(new ContentstackClientOptions()
             {
                 Host = _client.contentstackOptions.Host,
-                // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                 Authtoken = "blt_expired_token_simulation_12345"
             });
             var expiredStack = expiredTokenClient.Stack(_stack.APIKey);
@@ -2393,7 +2392,6 @@ public async Task Test061_Should_Fail_With_Insufficient_Asset_Permissions()
             var limitedPermClient = new ContentstackClient(new ContentstackClientOptions()
             {
                 Host = _client.contentstackOptions.Host,
-                // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                 Authtoken = "blt_limited_permissions_token_12345"
             });
             var limitedStack = limitedPermClient.Stack(_stack.APIKey);
@@ -2526,7 +2524,6 @@ public async Task Test065_Should_Block_Unauthorized_Asset_Deletion()
             var readOnlyClient = new ContentstackClient(new ContentstackClientOptions()
             {
                 Host = _client.contentstackOptions.Host,
-                // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                 Authtoken = "blt_readonly_token_12345"
             });
             var readOnlyStack = readOnlyClient.Stack(_stack.APIKey);
@@ -2561,7 +2558,6 @@ public async Task Test066_Should_Handle_Session_Timeout_During_Upload()
             var shortLivedClient = new ContentstackClient(new ContentstackClientOptions()
             {
                 Host = _client.contentstackOptions.Host,
-                // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                 Authtoken = "blt_short_lived_token_12345"
             });
             var shortLivedStack = shortLivedClient.Stack(_stack.APIKey);
@@ -2612,7 +2608,6 @@ public async Task Test067_Should_Validate_Asset_Access_Token_Scopes()
             var limitedScopeClient = new ContentstackClient(new ContentstackClientOptions()
             {
                 Host = _client.contentstackOptions.Host,
-                // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                 Authtoken = "blt_limited_scope_token_12345"
             });
             var limitedScopeStack = limitedScopeClient.Stack(_stack.APIKey);

Contentstack.Management.Core.Tests/IntegrationTest/Contentstack013_AssetTest.cs

@@ -27,7 +27,6 @@ public class Contentstack016_DeliveryTokenTest
         private DeliveryTokenModel _testTokenModel;
 
         // Constants for error testing
-        // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
         private const string NonExistentTokenUid = "blt00000000000000000000";
         private const string InvalidTokenUid = "invalid-uid-format";
         private const string MalformedTokenUid = "!@#$%^&*()";

Contentstack.Management.Core.Tests/IntegrationTest/Contentstack016_DeliveryTokenTest.cs

@@ -19,7 +19,6 @@ public class Contentstack019_RoleTest
         /// <summary>
         /// UID that should not exist on any stack (for negative-path tests).
         /// </summary>
-        // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
         private const string NonExistentRoleUid = "blt0000000000000000";
 
         private static ContentstackClient _client;
@@ -1643,7 +1642,6 @@ public void Test041_Should_Handle_Fetch_With_Invalid_Credentials_Sync()
             var invalidClient = new ContentstackClient(new ContentstackClientOptions()
             {
                 Host = _client.contentstackOptions.Host,
-                // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                 Authtoken = "blt_invalid_token_format"
             });
 
@@ -2002,7 +2000,6 @@ public void Test049_Should_Validate_Role_Stack_Isolation_Sync()
             try
             {
                 // Attempt to access role using different stack context
-                // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                 var differentStackKey = "blt_fake_stack_key_12345";
                 var differentStack = _client.Stack(differentStackKey);
 
@@ -2138,7 +2135,6 @@ public async Task Test052_Should_Validate_Role_Stack_Isolation_Async()
             try
             {
                 // Attempt to access role using different stack context
-                // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                 var differentStackKey = "blt_fake_stack_key_async_12345";
                 var differentStack = _client.Stack(differentStackKey);
 

Contentstack.Management.Core.Tests/IntegrationTest/Contentstack019_RoleTest.cs

@@ -488,7 +488,6 @@ public async System.Threading.Tasks.Task Test006_Should_Fail_To_Create_Variant_F
 
             TestOutputLogger.LogContext("TestScenario", "ProductBannerVariantLifecycle_Create_Negative");
 
-            // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
             var invalidEntryUid = "blt_invalid_entry_uid";
             var variantData = new { banner_color = "Navy Blue", _variant = new { _change_set = new[] { "banner_color" } } };
 
@@ -1242,7 +1241,6 @@ public void Test031_Should_Validate_Variant_Stack_Isolation_Sync()
             TestOutputLogger.LogContext("TestScenario", "Test031_Should_Validate_Variant_Stack_Isolation_Sync");
 
             // Attempt to access variant using different stack context
-            // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
             var differentStackKey = "blt_fake_stack_key_12345";
             var differentStack = _client.Stack(differentStackKey);
 
@@ -1487,7 +1485,6 @@ public async Task Test037_Should_Validate_Variant_Stack_Isolation_Async()
 
             TestOutputLogger.LogContext("TestScenario", "Test037_Should_Validate_Variant_Stack_Isolation_Async");
 
-            // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
             var differentStackKey = "blt_fake_stack_key_async_12345";
             var differentStack = _client.Stack(differentStackKey);
 
@@ -1862,7 +1859,6 @@ public void Test046_Should_Accept_Operations_With_Broken_Dependencies_Sync()
             TestOutputLogger.LogContext("TestScenario", "Test046_Should_Accept_Operations_With_Broken_Dependencies_Sync");
 
             // API is permissive with broken references - ignores invalid reference fields
-            // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
             var deletedEntryUid = "blt_deleted_entry_12345";
 
             var variantDataWithBrokenRefs = new
@@ -2226,7 +2222,6 @@ public async Task Test054_Should_Accept_Operations_With_Broken_Dependencies_Asyn
             TestOutputLogger.LogContext("TestScenario", "Test054_Should_Accept_Operations_With_Broken_Dependencies_Async");
 
             // API is permissive with broken references - ignores invalid reference fields
-            // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
             var deletedEntryUid = "blt_deleted_entry_async_12345";
 
             var variantDataWithBrokenRefs = new

Contentstack.Management.Core.Tests/IntegrationTest/Contentstack021_EntryVariantTest.cs

@@ -1660,7 +1660,6 @@ public async Task Test403_Should_Fail_With_Expired_Auth_Token()
             var expiredTokenClient = new ContentstackClient(new ContentstackClientOptions()
             {
                 Host = _client.contentstackOptions.Host,
-                // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                 Authtoken = "blt_expired_token_simulation_12345"
             });
             var expiredStack = expiredTokenClient.Stack(_stack.APIKey);
@@ -1701,7 +1700,6 @@ public async Task Test404_Should_Fail_With_Insufficient_Permissions()
             var limitedPermClient = new ContentstackClient(new ContentstackClientOptions()
             {
                 Host = _client.contentstackOptions.Host,
-                // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                 Authtoken = "blt_limited_permissions_token_12345"
             });
             var limitedStack = limitedPermClient.Stack(_stack.APIKey);
@@ -1769,7 +1767,6 @@ public async Task Test406_Should_Handle_Token_Refresh_Scenarios()
             var shortLivedClient = new ContentstackClient(new ContentstackClientOptions()
             {
                 Host = _client.contentstackOptions.Host,
-                // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                 Authtoken = "blt_short_lived_token_12345"
             });
             var shortLivedStack = shortLivedClient.Stack(_stack.APIKey);

Contentstack.Management.Core.Tests/IntegrationTest/Contentstack022_VariantGroupTest.cs

@@ -27,7 +27,6 @@ public class Contentstack023_PreviewTokenTest
         private Stack _stack;
         private string _deliveryTokenUid;
 
-        // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
         private const string NonExistentTokenUid = "blt00000000000000000000";
         private const string InvalidTokenUid = "invalid-uid-format";