@@ -9015,31 +9015,58 @@ exports.maskSecretUrls = exports.maskSigUrl = void 0;
90159015const core_1 = __nccwpck_require__(9728);
90169016/**
90179017 * Masks the `sig` parameter in a URL and sets it as a secret.
9018- * @param url The URL containing the `sig` parameter.
9019- * @returns A masked URL where the sig parameter value is replaced with '***' if found,
9020- * or the original URL if no sig parameter is present.
9018+ *
9019+ * @param url - The URL containing the signature parameter to mask
9020+ * @remarks
9021+ * This function attempts to parse the provided URL and identify the 'sig' query parameter.
9022+ * If found, it registers both the raw and URL-encoded signature values as secrets using
9023+ * the Actions `setSecret` API, which prevents them from being displayed in logs.
9024+ *
9025+ * The function handles errors gracefully if URL parsing fails, logging them as debug messages.
9026+ *
9027+ * @example
9028+ * ```typescript
9029+ * // Mask a signature in an Azure SAS token URL
9030+ * maskSigUrl('https://example.blob.core.windows.net/container/file.txt?sig=abc123&se=2023-01-01');
9031+ * ```
90219032 */
90229033function maskSigUrl(url) {
90239034 if (!url)
9024- return url ;
9035+ return;
90259036 try {
90269037 const parsedUrl = new URL(url);
90279038 const signature = parsedUrl.searchParams.get('sig');
90289039 if (signature) {
90299040 (0, core_1.setSecret)(signature);
90309041 (0, core_1.setSecret)(encodeURIComponent(signature));
90319042 parsedUrl.searchParams.set('sig', '***');
9032- return parsedUrl.toString();
90339043 }
90349044 }
90359045 catch (error) {
90369046 (0, core_1.debug)(`Failed to parse URL: ${url} ${error instanceof Error ? error.message : String(error)}`);
90379047 }
9038- return url;
90399048}
90409049exports.maskSigUrl = maskSigUrl;
90419050/**
9042- * Masks any URLs containing signature parameters in the provided object
9051+ * Masks sensitive information in URLs containing signature parameters.
9052+ * Currently supports masking 'sig' parameters in the 'signed_upload_url'
9053+ * and 'signed_download_url' properties of the provided object.
9054+ *
9055+ * @param body - The object should contain a signature
9056+ * @remarks
9057+ * This function extracts URLs from the object properties and calls maskSigUrl
9058+ * on each one to redact sensitive signature information. The function doesn't
9059+ * modify the original object; it only marks the signatures as secrets for
9060+ * logging purposes.
9061+ *
9062+ * @example
9063+ * ```typescript
9064+ * const responseBody = {
9065+ * signed_upload_url: 'https://blob.core.windows.net/?sig=abc123',
9066+ * signed_download_url: 'https://blob.core/windows.net/?sig=def456'
9067+ * };
9068+ * maskSecretUrls(responseBody);
9069+ * ```
90439070 */
90449071function maskSecretUrls(body) {
90459072 if (typeof body !== 'object' || body === null) {
0 commit comments