mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-25 08:09:07 +02:00
[client] Keep redacting URLs that carry a bracketed IPv6 host
Excluding square brackets from the match stopped the pattern from eating the prose after a URL, but brackets are also the IPv6 host delimiter. For `https://[2001:db8::1]/k?X-Amz-Signature=...` the pattern found nothing after the scheme and matched at all, so the URL survived whole — signed query included — in UploadFailureReason, the daemon log, and a remote job's failure record on the management server. Take a bracketed host in a leading group, then continue with the delimiter-free class as before. Two cases added, one with a port. Reported by cubic (P1) and CodeRabbit (CWE-200) on #7514.
This commit is contained in:
@@ -183,7 +183,11 @@ func getURLHash(url string) string {
|
||||
// backticks, angle brackets, parens and braces — so the match does not run past
|
||||
// the URL and swallow the prose after it. TrimRight below then drops trailing
|
||||
// sentence punctuation, which a bare URL at the end of a clause picks up.
|
||||
var urlInText = regexp.MustCompile("https?://[^\\s\"'`<>\\[\\]{}()]+")
|
||||
//
|
||||
// Square brackets are both a wrapper and part of the syntax: they delimit an
|
||||
// IPv6 host. The leading group takes a bracketed host when there is one, so an
|
||||
// IPv6 URL is still matched and redacted rather than left whole.
|
||||
var urlInText = regexp.MustCompile("https?://(?:\\[[^\\]\\s]+\\])?[^\\s\"'`<>\\[\\]{}()]*")
|
||||
|
||||
// redactedError keeps the original error reachable for errors.Is/As while
|
||||
// presenting a message with every URL cut down to scheme://host.
|
||||
|
||||
Reference in New Issue
Block a user