From 271a7fd2a4ceea96d8c80114c1bb766cc520ae01 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 11:18:28 +0900 Subject: [PATCH] test(security): expose CDC stop diagnostic leak --- .../com/xtrmetl/cdc/controller/CdcControllerTest.java | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/cdc-service/src/test/java/com/xtrmetl/cdc/controller/CdcControllerTest.java b/cdc-service/src/test/java/com/xtrmetl/cdc/controller/CdcControllerTest.java index 08cf2f5d..70d41df2 100644 --- a/cdc-service/src/test/java/com/xtrmetl/cdc/controller/CdcControllerTest.java +++ b/cdc-service/src/test/java/com/xtrmetl/cdc/controller/CdcControllerTest.java @@ -79,13 +79,15 @@ void testStopCdc() throws IOException { } @Test - void testStopCdcWithException() throws IOException { - doThrow(new IOException("Error stopping CDC")).when(cdcService).stop(); + void testStopCdcWithExceptionDoesNotExposeDiagnostic() throws IOException { + String sensitiveDiagnostic = "broker-password=secret-value at /srv/private/cdc.offsets"; + doThrow(new IOException(sensitiveDiagnostic)).when(cdcService).stop(); ResponseEntity response = cdcController.stopCdc(); assertEquals(HttpStatus.INTERNAL_SERVER_ERROR, response.getStatusCode()); - assertEquals("Error stopping CDC process: Error stopping CDC", response.getBody()); + assertEquals("Error stopping CDC process", response.getBody()); + assertFalse(response.getBody().contains(sensitiveDiagnostic)); verify(cdcService, times(1)).stop(); }