data_masking_test.cpp

Go to the documentation of this file.

// BSD 3-Clause License
// Copyright (c) 2025, 🍀☀🌕🌥 🌊
// See the LICENSE file in the project root for full license information.
 
#include <gtest/gtest.h>
#include <memory>
#include <string>
#include <sstream>
#include <vector>
#include <regex>
 
#include "database/backends/sqlite_backend.h"
#include "database/core/database_backend.h"
#include "database/query_builder.h"
 
using namespace database;
using namespace database::backends;
using namespace database::core;
 
class DataMaskingTest : public ::testing::Test {
protected:
    std::unique_ptr<sqlite_backend> db_;
 
    void SetUp() override {
        db_ = std::make_unique<sqlite_backend>();
#ifdef USE_SQLITE
        connection_config config;
        config.database = ":memory:";
        ASSERT_TRUE(db_->initialize(config).is_ok());
 
        // Create tables with sensitive data
        ASSERT_TRUE(db_->execute_query(
            "CREATE TABLE sensitive_data ("
            "  id INTEGER PRIMARY KEY,"
            "  ssn TEXT,"
            "  credit_card TEXT,"
            "  bank_account TEXT,"
            "  password_hash TEXT"
            ")"
        ).is_ok());
 
        // Insert test sensitive data
        auto insert_result = db_->execute_query(
            "INSERT INTO sensitive_data "
            "(id, ssn, credit_card, bank_account, password_hash) VALUES "
            "(1, '123-45-6789', '4111111111111111', 'ACC123456789', 'hash_secret_123')"
        );
        ASSERT_TRUE(insert_result.is_ok());
#else
        GTEST_SKIP() << "SQLite not available";
#endif
    }
 
    void TearDown() override {
        if (db_ && db_->is_initialized()) {
            db_->shutdown();
        }
    }
 
    bool containsSensitiveData(const std::string& str) {
        std::vector<std::string> sensitive_patterns = {
            "123-45-6789",       // SSN
            "4111111111111111",  // Credit card
            "ACC123456789",      // Bank account
            "hash_secret_123",   // Password hash
        };
 
        for (const auto& pattern : sensitive_patterns) {
            if (str.find(pattern) != std::string::npos) {
                return true;
            }
        }
        return false;
    }
};
 
//=============================================================================
// Exception Message Security Tests
//=============================================================================
 
TEST_F(DataMaskingTest, QueryResultsNotLeakedInExceptions) {
#ifdef USE_SQLITE
    // First, successfully query sensitive data
    auto query_result = db_->select_query("SELECT * FROM sensitive_data");
    ASSERT_TRUE(query_result.is_ok());
    ASSERT_FALSE(query_result.value().empty());
 
    // Now try to cause an error
    try {
        db_->execute_query("INVALID SQL SYNTAX ERROR");
        // If no exception, still pass - we're testing exception content
    } catch (const std::exception& e) {
        std::string error_msg = e.what();
 
        // Sensitive data from previous query should NOT appear in error
        EXPECT_FALSE(containsSensitiveData(error_msg))
            << "Sensitive data leaked in exception: " << error_msg;
    }
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}
 
TEST_F(DataMaskingTest, DatabaseErrorsNotLeakData) {
#ifdef USE_SQLITE
    // Query with intentional error after referencing sensitive table
    std::string bad_query = "SELECT * FROM sensitive_data WHERE invalid_column = 1";
 
    try {
        db_->select_query(bad_query);
    } catch (const std::exception& e) {
        std::string error_msg = e.what();
        EXPECT_FALSE(containsSensitiveData(error_msg))
            << "Sensitive data in database error: " << error_msg;
    }
 
    // This test passes even if no exception is thrown
    SUCCEED();
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}
 
//=============================================================================
// Debug Output Security Tests
//=============================================================================
 
TEST_F(DataMaskingTest, ResultDebugOutputMasked) {
#ifdef USE_SQLITE
    auto query_result = db_->select_query("SELECT * FROM sensitive_data");
    ASSERT_TRUE(query_result.is_ok());
    auto result = query_result.value();
    ASSERT_FALSE(result.empty());
 
    // If there's a to_string or debug method for results,
    // it should mask sensitive fields
 
    // Since database_result is std::vector<database_row>,
    // we can verify the principle by checking how we'd output it
    std::ostringstream debug_output;
    for (const auto& row : result) {
        for (const auto& [key, value] : row) {
            debug_output << key << "=";
            std::visit([&debug_output](const auto& v) {
                using T = std::decay_t<decltype(v)>;
                if constexpr (std::is_same_v<T, std::string>) {
                    debug_output << v;
                } else if constexpr (std::is_same_v<T, int64_t>) {
                    debug_output << v;
                } else if constexpr (std::is_same_v<T, double>) {
                    debug_output << v;
                } else if constexpr (std::is_same_v<T, bool>) {
                    debug_output << (v ? "true" : "false");
                } else {
                    debug_output << "null";
                }
            }, value);
            debug_output << " ";
        }
    }
 
    // This documents the need for masking - actual implementation
    // should mask fields like ssn, credit_card, password, etc.
    std::string output = debug_output.str();
 
    // If sensitive data appears, log a security note
    if (containsSensitiveData(output)) {
        // This is expected with raw output - document the need for masking
        SUCCEED() << "SECURITY NOTE: Raw database output contains sensitive data. "
                  << "Production systems should mask fields matching patterns like: "
                  << "ssn, credit_card, password, secret, etc.";
    }
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}
 
TEST_F(DataMaskingTest, QueryBuilderDoesNotLogSensitiveData) {
    std::stringstream captured;
    std::streambuf* original = std::clog.rdbuf(captured.rdbuf());
 
    {
        query_builder builder(database_types::sqlite);
        builder
            .select({"*"})
            .from("users")
            .where("ssn", "=", std::string("123-45-6789"))
            .where("credit_card", "=", std::string("4111111111111111"))
            .build();
    }
 
    std::clog.rdbuf(original);
    std::string log_output = captured.str();
 
    // Query builder should not log the actual values
    EXPECT_FALSE(containsSensitiveData(log_output))
        << "Sensitive data appeared in query builder logs: " << log_output;
}
 
//=============================================================================
// Sensitive Field Detection Tests
//=============================================================================
 
TEST_F(DataMaskingTest, SensitiveColumnNamePatterns) {
    std::vector<std::string> sensitive_patterns = {
        "password",
        "passwd",
        "pwd",
        "secret",
        "ssn",
        "social_security",
        "credit_card",
        "creditcard",
        "cc_number",
        "cvv",
        "card_number",
        "bank_account",
        "account_number",
        "routing_number",
        "api_key",
        "apikey",
        "auth_token",
        "access_token",
        "refresh_token",
        "private_key",
        "encryption_key",
    };
 
    // This test documents the patterns - actual implementation
    // should mask these automatically
    SUCCEED() << "Documented " << sensitive_patterns.size()
              << " sensitive column name patterns for masking";
}
 
//=============================================================================
// PII (Personally Identifiable Information) Tests
//=============================================================================
 
TEST_F(DataMaskingTest, PIINotInStackTraces) {
#ifdef USE_SQLITE
    // Query PII data
    auto query_result = db_->select_query("SELECT ssn FROM sensitive_data");
    ASSERT_TRUE(query_result.is_ok());
    ASSERT_FALSE(query_result.value().empty());
 
    // Cause an error and check stack trace doesn't contain PII
    try {
        throw std::runtime_error("Test error after PII access");
    } catch (const std::exception& e) {
        std::string what_msg = e.what();
        EXPECT_FALSE(containsSensitiveData(what_msg));
    }
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}
 
TEST_F(DataMaskingTest, LargeDataSetDoesNotLeakOnError) {
#ifdef USE_SQLITE
    // Insert more sensitive records
    for (int i = 2; i <= 100; ++i) {
        std::string query =
            "INSERT INTO sensitive_data (id, ssn, credit_card) VALUES (" +
            std::to_string(i) + ", '" +
            std::to_string(100 + i) + "-45-6789', '4" +
            std::string(15, '1' + (i % 9)) + "')";
        db_->execute_query(query);
    }
 
    // Query all data
    auto query_result = db_->select_query("SELECT * FROM sensitive_data");
    ASSERT_TRUE(query_result.is_ok());
    ASSERT_GE(query_result.value().size(), 100u);
 
    // If an error occurs, none of this data should appear in messages
    SUCCEED() << "Large datasets require careful error message construction";
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}
 
//=============================================================================
// Memory Security Tests
//=============================================================================
 
TEST_F(DataMaskingTest, SensitiveDataClearedFromResult) {
#ifdef USE_SQLITE
    {
        auto query_result = db_->select_query("SELECT * FROM sensitive_data");
        ASSERT_TRUE(query_result.is_ok());
        auto result = query_result.value();
        ASSERT_FALSE(result.empty());
 
        // Clear the result
        result.clear();
 
        // After clearing, result should be empty
        EXPECT_TRUE(result.empty());
    }
 
    // After scope exit, the data should be fully destroyed
    // Actual memory verification requires external tools
    SUCCEED() << "Result objects support clearing sensitive data";
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}
 
TEST_F(DataMaskingTest, StringValueSecureClearing) {
    // This documents the security requirement for clearing sensitive strings
    // Actual implementation should use secure_clear or similar
 
    std::string sensitive = "my_secret_password";
 
    // Standard clear() doesn't securely erase memory
    // Secure implementation should overwrite before deallocation
    sensitive.clear();
 
    // Document this security consideration
    SUCCEED() << "SECURITY NOTE: Use secure memory clearing for sensitive strings. "
              << "std::string::clear() does not securely erase memory.";
}
 
//=============================================================================
// Logging Level Security Tests
//=============================================================================
 
TEST_F(DataMaskingTest, DebugLogLevelDoesNotExposeSecrets) {
    // Even in debug mode, sensitive data should be masked
    // This is a design principle test
 
    SUCCEED() << "All log levels should mask sensitive data, including DEBUG";
}
 
TEST_F(DataMaskingTest, ErrorLogMasksSensitiveContext) {
#ifdef USE_SQLITE
    std::stringstream captured;
    std::streambuf* original = std::cerr.rdbuf(captured.rdbuf());
 
    // Trigger an error after querying sensitive data
    db_->select_query("SELECT * FROM sensitive_data");
    db_->execute_query("INVALID SYNTAX");
 
    std::cerr.rdbuf(original);
    std::string error_output = captured.str();
 
    // Error log should not contain sensitive data
    EXPECT_FALSE(containsSensitiveData(error_output))
        << "Sensitive data in error log: " << error_output;
#else
    GTEST_SKIP() << "SQLite not available";
#endif
}
 
//=============================================================================
// Data Redaction Tests
//=============================================================================
 
TEST_F(DataMaskingTest, CreditCardMaskingFormat) {
    // Credit cards should be masked as: ****-****-****-1234
    std::string full_cc = "4111111111111111";
    std::string masked_cc = "****-****-****-1111";  // Last 4 visible
 
    // Verify masking maintains last 4 digits
    EXPECT_EQ(full_cc.substr(full_cc.length() - 4), "1111");
 
    SUCCEED() << "Credit cards should be masked to show only last 4 digits";
}
 
TEST_F(DataMaskingTest, SSNMaskingFormat) {
    // SSN should be masked as: ***-**-6789
    std::string full_ssn = "123-45-6789";
    std::string masked_ssn = "***-**-6789";  // Last 4 visible
 
    SUCCEED() << "SSN should be masked to show only last 4 digits";
}