Repository navigation
fix(signing): redact scp-style remote credentials with a capitalized user - #3330
Merged
rudrankriyam merged 4 commits intoNov 3, 2026
Merged
Conversation
…user RedactRepoURL treated any change made by the URL sanitizer as proof that userinfo had been replaced. An scp-style remote such as Deploy:[email protected]:team/certs.git parses as an opaque URL with scheme "deploy"; rendering it only lowercases that scheme, so the token was returned unredacted. Only trust the sanitizer when net/url found an authority, and fall back to the scp-aware redaction otherwise. Assisted-by: AI (Grok Bot)
Preview approval requiredThis pull request comes from a fork, so Mintlify won't build a preview until someone with write access approves commit |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RedactRepoURL(used for signing repo remotes in errors, diagnostics and structured output) decided whether the URL sanitizer had replaced userinfo by checkingsanitized != trimmed. That check also fires whennet/urlonly re-renders the text. An scp-style remote with credentials and a capitalized user, for exampleparses as an opaque URL with scheme
deploy. The sanitizer sees noUser, andString()only lowercases the scheme, so the result differs from the input and is returned as is:The token stays in the output. The lowercase form (
user:secret@...) is already covered by a test and works only because the text happens to round-trip unchanged.Fix
Use the URL sanitizer only when
net/urlfound an authority (Host != "", noOpaque), which is the case where it can see and replace userinfo. Everything else (scp-style remotes, unparseable userinfo, local paths) goes to the existingredactRemoteUserinfofallback. Outputs for all existing test cases are unchanged.Tests
TestRedactRepoURLRemovesCredentials:Deploy:[email protected]:team/certs.gitmust become[REDACTED]@github.com:team/certs.git. It fails onmainwith the output above and passes with the fix.ASC_BYPASS_KEYCHAIN=1 go test ./internal/signing ./internal/cli/signingpasses;go vet ./internal/signingandgofmtare clean.AI assistance: I used an AI assistant to help find this and write the change; I checked the behavior and ran the tests above.