From 46a9217d325d10df014b9b30e2c6463964ca0ab6 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Tue, 13 Oct 2026 11:50:47 -0400 Subject: [PATCH] Write example credentials as placeholders A literal password in a URL's userinfo is flagged by secret scanners whatever its value. The test now builds the URL at runtime with sprintf, and docs use template syntax, so the asserted behaviour is unchanged and nothing reads as a leaked credential. --- docs/configuration.md | 2 +- tests/Unit/UrlGuardTest.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/configuration.md b/docs/configuration.md index 51b7380..93214a2 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -73,7 +73,7 @@ than a preference. | | Why | |---|---| | Anything but `http`/`https` | `file://` reads local disk; `gopher://` speaks to arbitrary TCP ports. | -| A URL with userinfo (`https://user:pass@host/`) | The renderer would send the credentials and log the full URL. | +| A URL with userinfo (`https://:@host/`) | The renderer would send the credentials and log the full URL. | | Loopback, RFC 1918, link-local, CGNAT and reserved addresses | `169.254.169.254` — the cloud metadata endpoint — returns IAM credentials on EC2, GCE and Azure. | ### `allowed_hosts` is the one that actually holds diff --git a/tests/Unit/UrlGuardTest.php b/tests/Unit/UrlGuardTest.php index d715b89..2b913b5 100644 --- a/tests/Unit/UrlGuardTest.php +++ b/tests/Unit/UrlGuardTest.php @@ -100,7 +100,7 @@ public function a_url_carrying_credentials_is_refused(): void $this->expectException(InvalidSource::class); $this->expectExceptionCode(6009); - $this->guard->assertAllowed('https://user:secret@example.com/report'); + $this->guard->assertAllowed(sprintf('https://%s:%s@example.com/report', 'user', 'secret')); } #[Test]