cc: @thaJeztah

Codecov Report

❗ No coverage uploaded for pull request base (master@299015d). Click here to learn what that means.
The diff coverage is 77.77%.

@@            Coverage Diff            @@
##             master   #37934   +/-   ##
=========================================
  Coverage          ?   36.09%           
=========================================
  Files             ?      610           
  Lines             ?    45160           
  Branches          ?        0           
=========================================
  Hits              ?    16302           
  Misses            ?    26621           
  Partials          ?     2237

Oh, we should update the swagger file as well, and update the description for these fields, to describe that credentials are masked when using the endpoint;

Also may warrant a mention in the API changelog https://github.com/moby/moby/blob/7bfec8cd80c5e2ce548cd7ccf63a35bf60d802d3/docs/api/version-history.md (although it's not versioned, so not sure how to best describe it there)

Oh, we should update the swagger file as well, and update the description for these fields, to describe that credentials are masked when using the endpoint;

moby/api/swagger.yaml

Lines 3760 to 3784 in 7bfec8c

   HttpProxy: 
     description: | 
       HTTP-proxy configured for the daemon. This value is obtained from the 
       [`HTTP_PROXY`](https://www.gnu.org/software/wget/manual/html_node/Proxies.html) environment variable. 

       Containers do not automatically inherit this configuration. 
     type: "string" 
     example: "http://user:[email protected]:8080" 
   HttpsProxy: 
     description: | 
       HTTPS-proxy configured for the daemon. This value is obtained from the 
       [`HTTPS_PROXY`](https://www.gnu.org/software/wget/manual/html_node/Proxies.html) environment variable. 

       Containers do not automatically inherit this configuration. 
     type: "string" 
     example: "https://user:[email protected]:4443" 
   NoProxy: 
     description: | 
       Comma-separated list of domain extensions for which no proxy should be 
       used. This value is obtained from the [`NO_PROXY`](https://www.gnu.org/software/wget/manual/html_node/Proxies.html) 
       environment variable. 

       Containers do not automatically inherit this configuration. 
     type: "string" 
     example: "*.local, 169.254/16" 

Also may warrant a mention in the API changelog https://github.com/moby/moby/blob/7bfec8cd80c5e2ce548cd7ccf63a35bf60d802d3/docs/api/version-history.md (although it's not versioned, so not sure how to best describe it there)

yes, good catch, I will update the swagger

I searched the moby code base and I don't see any place that reads the HTTPProxy or HTTPSProxy straight from the info struct.
I do share your concerns that some 3rd party code might be reading this info from the API and if this is the case, then we'll break their integration; but even if they do, I think it's still not correct design that we share the credentials through the info endpoint.

@thaJeztah
Changed the implementation as suggested and added couple of extra unit tests.
Note: I was under the impression that String() encodes the rest of the URL, not only the credentials part, but running few tests showed that it's not the case; by using xxxxx instead of ***** , we no longer need to worry about decoding/encoding the result of String()

Another note, while testing different URLs variations;
I noticed that the url method parse will fail to parse out credentials that are not escaped.
for example running parse on this url http://USER@docker:[email protected]:80/hello world , will result of no password or username set, this will cause the masking URL to look like this http://xxxxx:xxxxx@docker:[email protected]:80/hello world

The expectation here is that user should encode those type of strings when they configure HTTP(s) Proxy, otherwise, their dial will also fail as the core logic uses the same parse function

Also updated the swagger but not sure how to deal with the history file without having an API version

It's green! merging