Support sending output to stderr

cred-filter.go

@@ -45,13 +45,17 @@ func newEnvStringReplacer() *strings.Replacer {
 
 func main() {
 	envStringReplacer := newEnvStringReplacer()
-	buffer := make([]byte, 257 * 1024)
+	buffer := make([]byte, 257*1024)
 
 	scanner := bufio.NewScanner(os.Stdin)
-	scanner.Buffer(buffer, 257 * 1024)
+	scanner.Buffer(buffer, 257*1024)
 
 	for scanner.Scan() {
-		fmt.Fprintln(os.Stdout, envStringReplacer.Replace(scanner.Text()))
+		output := os.Stdout
+		if len(os.Args) > 1 && os.Args[1] == "-stderr" {
+			output = os.Stderr
+		}
+		fmt.Fprintln(output, envStringReplacer.Replace(scanner.Text()))
 	}
 	if err := scanner.Err(); err != nil {
 		fmt.Fprintln(os.Stderr, "error:", err)

cred-filter_test.go

@@ -1,44 +1,62 @@
 package main_test
 
 import (
+	"bytes"
 	"os/exec"
 	"strings"
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 )
 
-func runBinary(stdin string, env []string) (string, error) {
-	cmd := exec.Cmd{
-		Path:  "./cred-filter.exe",
-		Stdin: strings.NewReader(stdin),
-		Env:   env,
-	}
-	output, err := cmd.Output()
-	return string(output), err
+func runBinary(stdin string, args, env []string) (string, string, error) {
+	var stdout, stderr bytes.Buffer
+	cmd := exec.Command("./cred-filter.exe", args...)
+	cmd.Stdin = strings.NewReader(stdin)
+	cmd.Env = env
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	err := cmd.Run()
+	return stdout.String(), stderr.String(), err
 }
 
 var _ = Describe("CredFilter", func() {
+	var args []string
+	BeforeEach(func() {
+		args = []string{}
+	})
+
+	Context("Output to stderr instead", func() {
+		It("sends output to stderr instead", func() {
+			args = []string{"-stderr"}
+			output, stderr, err := runBinary("boring text", args, []string{})
+			Expect(err).To(BeNil())
+			Expect(output).To(Equal(""))
+			Expect(stderr).To(Equal("boring text\n"))
+		})
+	})
 
 	Context("No sensitive credentials available", func() {
 		It("outputs as is", func() {
 			env := []string{}
-			output, err := runBinary("boring text", env)
+			output, stderr, err := runBinary("boring text", args, env)
 			Expect(err).To(BeNil())
 			Expect(output).To(Equal("boring text\n"))
+			Expect(stderr).To(Equal(""))
 		})
 	})
 	Context("Sensitive credentials available", func() {
 		It("filters out those credentials", func() {
 			env := []string{"SECRET=secret", "INFO=info"}
-			output, err := runBinary("super secret info\nnew line", env)
+			output, _, err := runBinary("super secret info\nnew line", args, env)
 			Expect(err).To(BeNil())
 			Expect(output).To(Equal("super [redacted SECRET] [redacted INFO]\nnew line\n"))
 		})
 		Context("sensitive credential env var is whitelisted", func() {
 			It("filters out non-white-listed credentials", func() {
 				env := []string{"SECRET=secret", "INFO=info", "CREDENTIAL_FILTER_WHITELIST=OTHER1,INFO,OTHER2"}
-				output, err := runBinary("super secret info", env)
+				output, _, err := runBinary("super secret info", args, env)
 				Expect(err).To(BeNil())
 				Expect(output).To(Equal("super [redacted SECRET] info\n"))
 			})
@@ -48,7 +66,7 @@ var _ = Describe("CredFilter", func() {
 				env := []string{"SECRET=secret", "INFO=info", "CREDENTIAL_FILTER_WHITELIST=OTHER1,INFO,OTHER2"}
 				input := make([]byte, 256*1024)
 
-				_, err := runBinary(string(input[:]), env)
+				_, _, err := runBinary(string(input[:]), args, env)
 				Expect(err).To(BeNil())
 			})
 		})