package unit;

import java.util.ArrayList;
import java.util.List;

/**
 * CWE-312 unit test: gstreamer-0004 — RTSP proxy password logged verbatim
 *
 * Models gst_rtspsrc_set_proxy() in
 * subprojects/gst-plugins-good/gst/rtsp/gstrtspsrc.c line 2001:
 *
 *   DEFECT:
 *     GST_LOG_OBJECT (rtsp, "set proxy user/pw from properties: %s:%s",
 *         GST_STR_NULL (rtsp->proxy_user), GST_STR_NULL (rtsp->proxy_passwd));
 *
 *   Any process with GST_DEBUG="*:9" set (common during development/debugging)
 *   exposes the HTTP proxy password in plain text in the debug log.
 *
 *   FIX: log only the username, never the password.
 *     GST_LOG_OBJECT (rtsp, "set proxy user from properties: %s",
 *         GST_STR_NULL (rtsp->proxy_user));
 *
 * This test verifies:
 *   1. The defective version emits the password into the log buffer.
 *   2. The fixed version does NOT emit the password into the log buffer.
 */
public class Gstreamer0004RtspProxyPasswordTest {

    static List<String> logBuffer = new ArrayList<>();

    static void gstLogDefective(String user, String passwd) {
        // Mirrors: GST_LOG_OBJECT(rtsp, "set proxy user/pw from properties: %s:%s", user, passwd)
        logBuffer.add(String.format("set proxy user/pw from properties: %s:%s", user, passwd));
    }

    static void gstLogFixed(String user) {
        // Mirrors: GST_LOG_OBJECT(rtsp, "set proxy user from properties: %s", user)
        logBuffer.add(String.format("set proxy user from properties: %s", user));
    }

    static boolean logContainsPassword(String password) {
        for (String entry : logBuffer) {
            if (entry.contains(password)) return true;
        }
        return false;
    }

    public static void main(String[] args) {
        final String USER = "proxyuser";
        final String PASSWORD = "s3cr3tP@ssw0rd";

        System.out.println("gstreamer-0004 CWE-312 RTSP proxy password logging test");

        // Test 1: defective version — password appears in log
        logBuffer.clear();
        gstLogDefective(USER, PASSWORD);
        boolean defectExposesPassword = logContainsPassword(PASSWORD);

        System.out.println("  [defect] log entry: " + logBuffer.get(0));
        System.out.println("  [defect] password in log: " + defectExposesPassword);

        assert defectExposesPassword :
            "Defective logger should expose password in log — test setup error";

        // Test 2: fixed version — password does NOT appear in log
        logBuffer.clear();
        gstLogFixed(USER);
        boolean fixExposesPassword = logContainsPassword(PASSWORD);

        System.out.println("  [fix]    log entry: " + logBuffer.get(0));
        System.out.println("  [fix]    password in log: " + fixExposesPassword);

        assert !fixExposesPassword :
            "Fixed logger must not expose password in log";

        // Test 3: fixed version still logs the username
        boolean fixLogsUser = logBuffer.get(0).contains(USER);
        assert fixLogsUser : "Fixed logger should still log the username";

        System.out.println("  username still logged: " + fixLogsUser);
        System.out.println("PASS");
    }
}