Repository navigation
feat/CUS-10969-Added SHA-256 hash generator - #349
Merged
Merged
Conversation
📝 WalkthroughWalkthroughA new Testsigma addon module for SHA-256 hash generation is introduced, supporting multiple application types (Android, iOS, mobile web, REST API, web, and Windows) with corresponding Maven build configuration and SDK properties. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the Tip Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs). Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
sha-256_hash_generator/src/main/java/com/testsigma/addons/mobileweb/GenerateSHA256Hash.java (1)
32-63: Extract shared SHA-256 flow into a common utility/base helper.This execute logic is duplicated across multiple platform classes. Centralizing digest/hex/runtime-write logic will reduce drift and future bug fixes to one place.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@sha-256_hash_generator/src/main/java/com/testsigma/addons/mobileweb/GenerateSHA256Hash.java` around lines 32 - 63, Extract the SHA-256 digest and runtime-write logic from GenerateSHA256Hash.execute into a reusable helper (e.g., class Sha256Helper with methods generateHex(String) and storeAsRuntimeVariable(String hex, String varName, RunTimeData runTimeData)); replace the in-method MessageDigest/hexString loop and the runTimeData.setValue/setKey calls in GenerateSHA256Hash.execute with calls to these helper methods (keep logging and exception handling in execute but delegate digesting and variable storage to the helper) so other platform classes can call the same helper to eliminate duplicated code.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@sha-256_hash_generator/src/main/java/com/testsigma/addons/mobileweb/GenerateSHA256Hash.java`:
- Around line 38-39: The code in GenerateSHA256Hash is logging sensitive values
(originalText and the computed hashes); remove or redact any logger calls that
print originalText, generatedHash, or similar variables and replace them with
non-sensitive operational messages (e.g., log only success/failure and a
non-sensitive identifier such as a key or request ID). Locate logger.info
invocations in GenerateSHA256Hash that reference originalText, generatedHash, or
hashedValue and change them to generic messages like "SHA256 generation
succeeded for key: <keyId>" or log only exceptions/errors without revealing the
plaintext or hash.
In `@sha-256_hash_generator/src/main/resources/testsigma-sdk.properties`:
- Line 1: The file contains a hardcoded secret value for the property
testsigma-sdk.api.key; remove this committed API key immediately from the file
and git history, rotate/revoke the exposed key with the provider, and replace
the literal with a runtime-secret lookup (e.g., read testsigma-sdk.api.key from
environment or a secrets manager in your configuration/bootstrap code). After
rotating the key, scrub the repository history (git filter-repo / BFG) or remove
the commit and force-push, update CI/deployment to inject the secret securely,
and ensure testsigma-sdk.properties no longer contains any plaintext secret.
---
Nitpick comments:
In
`@sha-256_hash_generator/src/main/java/com/testsigma/addons/mobileweb/GenerateSHA256Hash.java`:
- Around line 32-63: Extract the SHA-256 digest and runtime-write logic from
GenerateSHA256Hash.execute into a reusable helper (e.g., class Sha256Helper with
methods generateHex(String) and storeAsRuntimeVariable(String hex, String
varName, RunTimeData runTimeData)); replace the in-method
MessageDigest/hexString loop and the runTimeData.setValue/setKey calls in
GenerateSHA256Hash.execute with calls to these helper methods (keep logging and
exception handling in execute but delegate digesting and variable storage to the
helper) so other platform classes can call the same helper to eliminate
duplicated code.
ℹ️ Review info
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (8)
sha-256_hash_generator/pom.xmlsha-256_hash_generator/src/main/java/com/testsigma/addons/android/GenerateSHA256Hash.javasha-256_hash_generator/src/main/java/com/testsigma/addons/ios/GenerateSHA256Hash.javasha-256_hash_generator/src/main/java/com/testsigma/addons/mobileweb/GenerateSHA256Hash.javasha-256_hash_generator/src/main/java/com/testsigma/addons/restapi/GenerateSHA256Hash.javasha-256_hash_generator/src/main/java/com/testsigma/addons/web/GenerateSHA256Hash.javasha-256_hash_generator/src/main/java/com/testsigma/addons/windows/GenerateSHA256Hash.javasha-256_hash_generator/src/main/resources/testsigma-sdk.properties
Comment on lines
+38
to
+39
| logger.info("Original text is: " + originalText); | ||
|
|
There was a problem hiding this comment.
Do not log plaintext input or generated hash values.
Line 38 logs raw input; Lines 50 and 55 expose derived hash values. This can leak sensitive data in logs/reports. Keep only non-sensitive operational logs (e.g., success/failure, variable key only).
Also applies to: 50-55
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@sha-256_hash_generator/src/main/java/com/testsigma/addons/mobileweb/GenerateSHA256Hash.java`
around lines 38 - 39, The code in GenerateSHA256Hash is logging sensitive values
(originalText and the computed hashes); remove or redact any logger calls that
print originalText, generatedHash, or similar variables and replace them with
non-sensitive operational messages (e.g., log only success/failure and a
non-sensitive identifier such as a key or request ID). Locate logger.info
invocations in GenerateSHA256Hash that reference originalText, generatedHash, or
hashedValue and change them to generic messages like "SHA256 generation
succeeded for key: <keyId>" or log only exceptions/errors without revealing the
plaintext or hash.
| @@ -0,0 +1 @@ | |||
| testsigma-sdk.api.key=eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIyMjMyMmM2Ni04NWYzLWIyN2UtN2FiOS0zM2U2M2Q4OWM1MGIiLCJ1bmlxdWVJZCI6IjYwMDkiLCJpZGVudGl0eUFjY291bnRVVUlkIjoiMzUifQ.pFlgZ1lCeHGOn8-F4tUnnto8khVAvO1AmVYVGCpnUxkD3SW5fgQNYt00psO72nDdDKB16scbb3XXGBArg5GnnQ No newline at end of file | |||
There was a problem hiding this comment.
Remove committed API key from source control immediately.
A live-looking SDK key is hardcoded on Line 1. This is a direct secret exposure risk, especially for a public addon. Rotate/revoke this key, remove it from git history, and inject it via secure secret management at runtime/CI.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@sha-256_hash_generator/src/main/resources/testsigma-sdk.properties` at line
1, The file contains a hardcoded secret value for the property
testsigma-sdk.api.key; remove this committed API key immediately from the file
and git history, rotate/revoke the exposed key with the provider, and replace
the literal with a runtime-secret lookup (e.g., read testsigma-sdk.api.key from
environment or a secrets manager in your configuration/bootstrap code). After
rotating the key, scrub the repository history (git filter-repo / BFG) or remove
the commit and force-push, update CI/deployment to inject the secret securely,
and ensure testsigma-sdk.properties no longer contains any plaintext secret.
vignesh-testsigma
approved these changes
Mar 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publish this addon as PUBLIC
Addon Name: SHA-256 Hash Generator
Jarvis Link: https://jarvis.testsigma.com/ui/tenants/2817/addons
Jira : https://testsigma.atlassian.net/browse/CUS-10969
Added SHA-256 hash generator
Summary by CodeRabbit
Release Notes