sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-25 16:19:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Keep redacting URLs that carry a bracketed IPv6 host

Browse Source 
Excluding square brackets from the match stopped the pattern from eating the
prose after a URL, but brackets are also the IPv6 host delimiter. For
`https://[2001:db8::1]/k?X-Amz-Signature=...` the pattern found nothing after
the scheme and matched at all, so the URL survived whole — signed query
included — in UploadFailureReason, the daemon log, and a remote job's failure
record on the management server.

Take a bracketed host in a leading group, then continue with the delimiter-free
class as before. Two cases added, one with a port.

Reported by cubic (P1) and CodeRabbit (CWE-200) on #7514.
This commit is contained in:
riccardom
2026-09-23 12:34:40 +02:00
parent 60d1181535
commit c3993bef73
2 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/internal/debug/upload_redact_test.go
+13
View File
@@ -68,6 +68,19 @@ func TestRedactURLsInError(t *testing.T) {
err: errors.New("use `https://b.example.com/p` instead"),
want: "use `https://b.example.com` instead",
},
{
// Square brackets delimit an IPv6 host, so excluding them from the
// match entirely leaves an IPv6 URL — signed query and all —
// untouched in the message.
name: "bracketed IPv6 host is still redacted",
err: errors.New(`upload failed: Put "https://[2001:db8::1]/k?X-Amz-Signature=abc123": timeout`),
want: `upload failed: Put "https://[2001:db8::1]": timeout`,
},
{
name: "IPv6 host with a port is still redacted",
err: errors.New(`Get "https://[2001:db8::1]:8443/upload-url?id=deadbeef": no such host`),
want: `Get "https://[2001:db8::1]:8443": no such host`,
},
}
for _, tc := range tests {