fix: sanitize special characters in URLs (#21575)

renovatebot · Apr 19, 2023 · 18d0fbc · 18d0fbc
1 parent 14dbd5e
commit 18d0fbc
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/lib/logger/utils.spec.ts b/lib/logger/utils.spec.ts
@@ -37,6 +37,7 @@ describe('logger/utils', () => {
     input                                                                 | output
     ${' https://somepw@domain.com/gitlab/org/repo?go-get'}                | ${' https://**redacted**@domain.com/gitlab/org/repo?go-get'}
     ${'https://someuser:somepw@domain.com'}                               | ${'https://**redacted**@domain.com'}
+    ${'https://someuser:pass%word_with-speci(a)l&chars@domain.com'}       | ${'https://**redacted**@domain.com'}
     ${'https://someuser:@domain.com'}                                     | ${'https://**redacted**@domain.com'}
     ${'redis://:somepw@172.32.11.71:6379/0'}                              | ${'redis://**redacted**@172.32.11.71:6379/0'}
     ${'some text with\r\n url: https://somepw@domain.com\nand some more'} | ${'some text with\r\n url: https://**redacted**@domain.com\nand some more'}

diff --git a/lib/logger/utils.ts b/lib/logger/utils.ts
@@ -244,7 +244,7 @@ export function validateLogLevel(logLevelToCheck: string | undefined): void {
 }
 
 // Can't use `util/regex` because of circular reference to logger
-const urlRe = /[a-z]{3,9}:\/\/[-;:&=+$,\w]+@[a-z0-9.-]+/gi;
+const urlRe = /[a-z]{3,9}:\/\/[^@/]+@[a-z0-9.-]+/gi;
 const urlCredRe = /\/\/[^@]+@/g;
 
 export function sanitizeUrls(text: string): string {