Skip to content

fix(redact): a login in a logged URL is masked #198

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
derek-miller merged 3 commits into from
Nov 10, 2026
Merged

fix(redact): a login in a logged URL is masked #198

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e662527
fix(redact): a login in a logged URL is masked
derek-miller Nov 10, 2026
b66dede
test(redact): a raw ' or , in a URL's password is masked whole
derek-miller Nov 10, 2026
a0add64
Merge remote-tracking branch 'origin/main' into fix/redact-url-logins
derek-miller Nov 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions template/src/lib/redact.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,9 @@ local function redactSerialized(text)
return key .. separator .. '"' .. REDACTED .. '"'
end
end)
-- A URL's login: rtsp://user:pass@host. As a browser reads it, the login runs to the last "@" before the
-- host ends at "/", "?" or "#", so a raw "@" in a password is masked whole and one in a query is left alone.
text = text:gsub('(://)[^/?#%s"]+@', "%1" .. REDACTED .. "@")

@svc-finitelabs svc-finitelabs Bot Nov 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: the class stops at " but not at ' or ,, so a single-quoted or comma-separated URL that is followed by an email loses its host: url='http://host',user=a@b.com becomes url='http://***REDACTED***@b.com. That fails closed, so nothing leaks, but the line no longer says which host it was. Adding ' next to " ([^/?#%s"']+@) covers the quoted case.

@derek-miller derek-miller Nov 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Declined, and pinned with a test in b66dede. ' and , are sub-delims, legal raw in a URL login (RFC 3986 section 3.2.1), so a class that stops at either prints a password holding one: with [^/?#%s"'], rtsp://viewer:it's@192.0.2.20/live comes out whole. The current class can hide the host in your quoted case but never a secret, and failing closed is the side lib.redact takes. " is different: it can't stand raw in a URL, and in JSON text it ends the string. The new check "a raw ' or , in the password masked whole" fails if either character is added to the class.

return redactPairs(text)
end

Expand Down
53 changes: 53 additions & 0 deletions template/test/test_http_redact.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -275,4 +275,57 @@ do
T.check("form value masked through its slash", out == "password=" .. REDACTED .. "&next=/home", out)
end

--------------------------------------------------------------------------------
T.section("A URL's login is masked")
--------------------------------------------------------------------------------
do
local out = redact("rtsp://viewer:CAM_PASS_LEAK@192.0.2.20:554/stream1")
T.check("user and password masked", out == "rtsp://" .. REDACTED .. "@192.0.2.20:554/stream1", out)

out = redact("https://USER_LEAK@example.com/api")
T.check("a bare user masked", out == "https://" .. REDACTED .. "@example.com/api", out)

out = R.text("rtsp://viewer:CAM_PASS_LEAK@192.0.2.20")
T.check("masked by redact.text, with no path", out == "rtsp://" .. REDACTED .. "@192.0.2.20", out)

out = redact("rtsp://viewer:p@ss_LEAK@192.0.2.20/live")
T.check("a raw @ in the password masked whole", out == "rtsp://" .. REDACTED .. "@192.0.2.20/live", out)

-- "'" and "," may stand raw in a login, so stopping at either would print this password whole.
out = redact("rtsp://viewer:it's,ok_LEAK@192.0.2.20/live")
T.check("a raw ' or , in the password masked whole", out == "rtsp://" .. REDACTED .. "@192.0.2.20/live", out)

out = redact("rtsp://viewer:CAM_PASS_LEAK@192.0.2.20/live?token=QUERY_TOKEN_LEAK&channel=1")
T.check(
"a query token still masked beside the login",
out == "rtsp://" .. REDACTED .. "@192.0.2.20/live?token=" .. REDACTED .. "&channel=1",
out
)

out = redact('{"name":"Front Camera","stream":"rtsp://viewer:CAM_PASS_LEAK@192.0.2.20/live"}')
T.excludes("a login in JSON text masked", out, "CAM_PASS_LEAK")
T.contains("the JSON text's URL keeps its host", out, "rtsp://" .. REDACTED .. "@192.0.2.20/live")
T.contains("the JSON text's other members kept", out, "Front Camera")

out = encoded(redact({ name = "Front Camera", streams = { "rtsp://viewer:CAM_PASS_LEAK@192.0.2.20/live" } }))
T.excludes("a login in a table leaf masked", out, "CAM_PASS_LEAK")
T.contains("the table leaf keeps its host", out, "rtsp://" .. REDACTED .. "@192.0.2.20/live")
end

--------------------------------------------------------------------------------
T.section("An @ that is not a login stays readable")
--------------------------------------------------------------------------------
do
for _, text in ipairs({
"https://example.com?email=user@example.com",
"https://example.com#user@example.com",
"https://example.com/users/user@example.com",
"GET https://example.com for user@example.com",
'{"url":"https://example.com","email":"user@example.com"}',
}) do
local out = R.text(text)
T.check("left alone: " .. text, out == text, out)
end
end

T.finish()
Loading