From 943238acf3173da4e66e008c81caefc18e030910 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 17 Jul 2026 03:42:28 +0000 Subject: [PATCH] test(reporting): align 500 assertion with sanitized detail reporting_routes.generate_dashboard_url already returns a static detail="Internal server error" (CWE-209 hardening), but test_generate_dashboard_url_service_error still asserted the old "Failed to generate" substring, leaving main CI red on the `test` job (1 failed, 7163 passed). Update the assertion to expect the sanitized body and to prove the caught exception text ("Looker unavailable") does not leak. This is the same test change already staged in PR #818; landing it directly unblocks main. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_014BmkwKENnbsy3v94m1sBid --- tests/unit/test_cloud_routes.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/unit/test_cloud_routes.py b/tests/unit/test_cloud_routes.py index daa292c72..6bb1e89a2 100644 --- a/tests/unit/test_cloud_routes.py +++ b/tests/unit/test_cloud_routes.py @@ -1316,7 +1316,11 @@ def test_generate_dashboard_url_service_error(self): } ) assert response.status_code == 500 - assert "Failed to generate" in response.json()["detail"] + # The 500 body must be sanitized (CWE-209): a static message, never the + # caught exception text. See reporting_routes.generate_dashboard_url. + detail = response.json()["detail"] + assert detail == "Internal server error" + assert "Looker unavailable" not in detail def test_generate_dashboard_url_missing_fields(self): """Missing required fields return 422."""