Added URL secrets redaction fix #1006 - #1007
Conversation
Added a function to redact secrets in URLs so that they do not get leaked in logs.
Applied code formatting.
fallenmi
left a comment
fallenmi
left a comment
There was a problem hiding this comment.
The token-only URL form still leaks the credential on reconnect.
connect() explicitly treats username-only URL userinfo as an authentication token, and the existing test_connect_uses_token_from_url covers that supported form. At exact head cfe39caff85b88c0c8669cfdcc9c5b8e05a72168, this regression oracle fails:
safe = _redact_url("nats://token-secret@example.com:4222")
assert "token-secret" not in safeBecause u.password is None, _redact_url returns the original URL unchanged. Validation showed the password-form oracle moving from RED on the exact base to GREEN on this head, while the token-form oracle remains RED on both; the exact-head nats-core/tests/test_client.py suite is otherwise green (175 passed), so it currently does not exercise token redaction.
Please redact username-only userinfo as well and add a regression for the supported token URL form.
Reviewed with OpenAI Codex assistance.
This commit improves _redact_url to handle token-form and URLs with implicit protocol. It also introduces tests for this function.
3 participants
Added a function to redact secrets in URLs so that they do not get leaked in logs.