From 82aa7f7b04680ac7564bfe9ffdab69954053c448 Mon Sep 17 00:00:00 2001 From: riccardom Date: Mon, 14 Sep 2026 09:16:51 +0200 Subject: [PATCH] [client] Log only scheme and host of the debug bundle upload URL The URL reaches the daemon from the management server or from the caller and can carry userinfo or a token in its query. Both log lines wrote it whole, into the file that then ships inside the very bundles this uploads. Reported by CodeRabbit (CWE-532) and cubic on #7514. --- client/server/debug.go | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/client/server/debug.go b/client/server/debug.go index d7d1f388d..a01e6a319 100644 --- a/client/server/debug.go +++ b/client/server/debug.go @@ -7,6 +7,7 @@ import ( "context" "errors" "fmt" + "net/url" "path/filepath" "runtime/pprof" "strings" @@ -57,15 +58,27 @@ func (s *Server) DebugBundle(callerCtx context.Context, req *proto.DebugBundleRe defer cancel() key, err := debug.UploadDebugBundle(uploadCtx, uploadURL, managementURL, path, req.GetUploadInsecure()) if err != nil { - log.Errorf("failed to upload debug bundle to %s: %v", uploadURL, err) + log.Errorf("failed to upload debug bundle to %s: %v", redactUploadURL(uploadURL), err) return &proto.DebugBundleResponse{Path: path, UploadFailureReason: err.Error()}, nil } - log.Infof("debug bundle uploaded to %s with key %s", uploadURL, key) + log.Infof("debug bundle uploaded to %s with key %s", redactUploadURL(uploadURL), key) return &proto.DebugBundleResponse{Path: path, UploadedKey: key}, nil } +// redactUploadURL reduces an upload URL to scheme://host for logging. The URL +// reaches the daemon from the management server or the caller and can carry +// userinfo or a token in its query, neither of which belongs in a log file that +// ends up inside the very bundles this uploads. +func redactUploadURL(raw string) string { + parsed, err := url.Parse(raw) + if err != nil || parsed.Host == "" { + return "(unparsable upload URL)" + } + return parsed.Scheme + "://" + parsed.Host +} + // generateDebugBundle builds the bundle under s.mutex and returns its path plus // the management URL and the upload service the management server publishes, // both captured under the lock, so the caller can run the upload without