test_secret_injection.py — langchain Source File

Source Code

"""Tests for secret injection prevention in serialization.

Verify that user-provided data containing secret-like structures cannot be used to
extract environment variables during deserialization.
"""

import json
import os
import re
from typing import Any
from unittest import mock

import pytest
from pydantic import BaseModel

from langchain_core.documents import Document
from langchain_core.load import dumpd, dumps, load
from langchain_core.messages import AIMessage, HumanMessage
from langchain_core.outputs import ChatGeneration

SENTINEL_ENV_VAR = "TEST_SECRET_INJECTION_VAR"
"""Sentinel value that should NEVER appear in serialized output."""

SENTINEL_VALUE = "LEAKED_SECRET_MEOW_12345"
"""Sentinel value that should NEVER appear in serialized output."""

MALICIOUS_SECRET_DICT: dict[str, Any] = {
    "lc": 1,
    "type": "secret",
    "id": [SENTINEL_ENV_VAR],
}
"""The malicious secret-like dict that tries to read the env var"""


@pytest.fixture(autouse=True)
def _set_sentinel_env_var() -> Any:
    """Set the sentinel env var for all tests in this module."""
    with mock.patch.dict(os.environ, {SENTINEL_ENV_VAR: SENTINEL_VALUE}):
        yield


def _assert_no_secret_leak(payload: Any) -> None:
    """Assert that serializing/deserializing payload doesn't leak the secret."""
    # First serialize
    serialized = dumps(payload)

    # Deserialize with secrets_from_env=True (the dangerous setting)
    deserialized = load(serialized, secrets_from_env=True)

    # Re-serialize to string
    reserialized = dumps(deserialized)

    assert SENTINEL_VALUE not in reserialized, (
        f"Secret was leaked! Found '{SENTINEL_VALUE}' in output.\n"
        f"Original payload type: {type(payload)}\n"
        f"Reserialized output: {reserialized[:500]}..."
    )

    assert SENTINEL_VALUE not in repr(deserialized), (
        f"Secret was leaked in deserialized object! Found '{SENTINEL_VALUE}'.\n"
// ... (372 more lines)