fix(logger): sanitize urls in strings (#15102)

renovatebot · Apr 14, 2022 · 6ef2b8c · 6ef2b8c
1 parent ee582fe
commit 6ef2b8c
Show file tree

Hide file tree

Showing 4 changed files with 27 additions and 4 deletions.
diff --git a/lib/logger/__snapshots__/err-serializer.spec.ts.snap b/lib/logger/__snapshots__/err-serializer.spec.ts.snap
@@ -15,7 +15,7 @@ Object {
     "http2": false,
     "method": "POST",
     "password": "***********",
-    "url": "https://:**redacted**@github.com/api",
+    "url": "https://**redacted**@github.com/api",
     "username": "",
   },
   "response": Object {

diff --git a/lib/logger/err-serializer.spec.ts b/lib/logger/err-serializer.spec.ts
@@ -106,7 +106,7 @@ describe('logger/err-serializer', () => {
         options: {
           method: 'POST',
           password: '***********',
-          url: 'https://:**redacted**@github.com/api',
+          url: 'https://**redacted**@github.com/api',
           username: '',
         },
       });

diff --git a/lib/logger/utils.spec.ts b/lib/logger/utils.spec.ts
@@ -1,4 +1,4 @@
-import { validateLogLevel } from './utils';
+import { sanitizeValue, validateLogLevel } from './utils';
 
 describe('logger/utils', () => {
   afterEach(() => {
@@ -30,4 +30,17 @@ describe('logger/utils', () => {
     }).toThrow();
     expect(mockExit).toHaveBeenCalledWith(1);
   });
+
+  it.each`
+    input                                                                 | output
+    ${' https://somepw@domain.com/gitlab/org/repo?go-get'}                | ${' https://**redacted**@domain.com/gitlab/org/repo?go-get'}
+    ${'https://someuser:somepw@domain.com'}                               | ${'https://**redacted**@domain.com'}
+    ${'https://someuser:@domain.com'}                                     | ${'https://**redacted**@domain.com'}
+    ${'redis://:somepw@172.32.11.71:6379/0'}                              | ${'redis://**redacted**@172.32.11.71:6379/0'}
+    ${'some text with\r\n url: https://somepw@domain.com\nand some more'} | ${'some text with\r\n url: https://**redacted**@domain.com\nand some more'}
+    ${'[git://domain.com](git://pw@domain.com)'}                          | ${'[git://domain.com](git://**redacted**@domain.com)'}
+    ${'user@domain.com'}                                                  | ${'user@domain.com'}
+  `('sanitizeValue("$input") == "$output"', ({ input, output }) => {
+    expect(sanitizeValue(input)).toBe(output);
+  });
 });
diff --git a/lib/logger/utils.ts b/lib/logger/utils.ts
@@ -103,7 +103,7 @@ export function sanitizeValue(
   seen = new WeakMap<NestedValue, unknown>()
 ): any {
   if (is.string(value)) {
-    return sanitize(value);
+    return sanitize(sanitizeUrls(value));
   }
 
   if (is.date(value)) {
@@ -243,3 +243,13 @@ export function validateLogLevel(logLevelToCheck: string | undefined): void {
   logger.fatal(`${logLevelToCheck} is not a valid log level. terminating...`);
   process.exit(1);
 }
+
+// Can't use `util/regex` because of circular reference to logger
+const urlRe = /[a-z]{3,9}:\/\/[-;:&=+$,\w]+@[a-z0-9.-]+/gi;
+const urlCredRe = /\/\/[^@]+@/g;
+
+export function sanitizeUrls(text: string): string {
+  return text.replace(urlRe, (url) => {
+    return url.replace(urlCredRe, '//**redacted**@');
+  });
+}