sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-24 23:59:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Keep redacting URLs that carry a bracketed IPv6 host

Browse Source 
Excluding square brackets from the match stopped the pattern from eating the
prose after a URL, but brackets are also the IPv6 host delimiter. For
`https://[2001:db8::1]/k?X-Amz-Signature=...` the pattern found nothing after
the scheme and matched at all, so the URL survived whole — signed query
included — in UploadFailureReason, the daemon log, and a remote job's failure
record on the management server.

Take a bracketed host in a leading group, then continue with the delimiter-free
class as before. Two cases added, one with a port.

Reported by cubic (P1) and CodeRabbit (CWE-200) on #7514.
This commit is contained in:
riccardom
2026-09-23 12:34:40 +02:00
parent 60d1181535
commit c3993bef73
2 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/internal/debug/upload.go
+5 -1
View File
@@ -183,7 +183,11 @@ func getURLHash(url string) string {
// backticks, angle brackets, parens and braces — so the match does not run past
// the URL and swallow the prose after it. TrimRight below then drops trailing
// sentence punctuation, which a bare URL at the end of a clause picks up.
var urlInText = regexp.MustCompile("https?://[^\\s\"'`<>\\[\\]{}()]+")
//
// Square brackets are both a wrapper and part of the syntax: they delimit an
// IPv6 host. The leading group takes a bracketed host when there is one, so an
// IPv6 URL is still matched and redacted rather than left whole.
var urlInText = regexp.MustCompile("https?://(?:\\[[^\\]\\s]+\\])?[^\\s\"'`<>\\[\\]{}()]*")
// redactedError keeps the original error reachable for errors.Is/As while
// presenting a message with every URL cut down to scheme://host.
client/internal/debug/upload_redact_test.go
+13
View File
@@ -68,6 +68,19 @@ func TestRedactURLsInError(t *testing.T) {
err: errors.New("use `https://b.example.com/p` instead"),
want: "use `https://b.example.com` instead",
},
{
// Square brackets delimit an IPv6 host, so excluding them from the
// match entirely leaves an IPv6 URL — signed query and all —
// untouched in the message.
name: "bracketed IPv6 host is still redacted",
err: errors.New(`upload failed: Put "https://[2001:db8::1]/k?X-Amz-Signature=abc123": timeout`),
want: `upload failed: Put "https://[2001:db8::1]": timeout`,
},
{
name: "IPv6 host with a port is still redacted",
err: errors.New(`Get "https://[2001:db8::1]:8443/upload-url?id=deadbeef": no such host`),
want: `Get "https://[2001:db8::1]:8443": no such host`,
},
}
for _, tc := range tests {