Redact credentials from Git URLs in logs #184
Conversation
🦋 Changeset detectedLatest commit: 7994fa7 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
commit: |
🐳 Docker Image PublishedFROM cloudflare/sandbox:0.0.0-pr-184-4670919Version: You can use this Docker image with the preview package from this PR. |
Git URLs with authentication tokens were leaking in logs during clone operations. Added GitLogger wrapper to automatically sanitize credentials from all log output.
ghostwriternr
force-pushed
the
redact-creds-git-checkout
branch
from
b844100 to
65a3e33
Compare
The regex-based approach now correctly handles URLs embedded in error messages. Simplified sanitizeGitData() to use general recursion for all fields instead of field-specific logic.
Replaces regex pattern with simple string scanning to eliminate ReDoS vulnerability while maintaining credential redaction.
URL boundary detection now stops at structural delimiters (quotes, brackets) to handle JSON/XML formats correctly. GitLogger now sanitizes Error objects to prevent credential leaks when error messages contain repository URLs. Replace 'any' with Record<string, unknown> for type safety.
Claude Code ReviewSummary: This PR effectively addresses credential leakage in Git URLs with a well-structured solution. The implementation is solid with comprehensive test coverage. Architecture & ImplementationStrengths:
Minor concerns:
TestingExcellent coverage:
Missing: No test for URL-encoded auth like user%40email:pass@host VerdictApprove with minor suggestions. Core functionality is sound and solves the security issue effectively. Concerns are optimizations/edge cases that don't block merging. |
1 participant
Credentials embedded in repository URLs (tokens, usernames, passwords) are now replaced with
******before logging. This prevents sensitive data from appearing in logs when cloning private repos.Fixes #177