Commit d61e79e3 authored by Bob Van Landuyt's avatar Bob Van Landuyt 💬
Browse files

Merge branch 'vs/fix-sanitizer-uri-gem-104' into 'master' 

fix(sanitizer): handle password clearing in URI

See merge request !193

Merged-by: Bob Van Landuyt's avatarBob Van Landuyt <bob@gitlab.com>
Approved-by: Bob Van Landuyt's avatarBob Van Landuyt <bob@gitlab.com>
Reviewed-by: Bob Van Landuyt's avatarBob Van Landuyt <bob@gitlab.com>
Co-authored-by: default avatarVitaly Slobodin <vslobodin@gitlab.com>
parents 6cb3c9bd ec61cf5f

lib/labkit/logging/sanitizer.rb

+8 −1
Original line number Diff line number Diff line 
# frozen_string_literal: true



require "pg_query"

require "uri"



module Labkit

  module Logging
@@ -47,8 +48,14 @@ module Labkit 
        #     URI::RFC2396_PARSER.parse('ssh://') => raise URI::InvalidURIError

        return "" if p.host.empty?



        p.password = "*****" if p.password.present?

        # Starting from v1.0.4, the `uri` gem clears the `password` instance variable

        # when the `user` setter is called. To preserve the current behavior,

        # we store the `password` in a temporary variable.

        password = p.password



        p.user = "*****" if p.user.present?

        p.password = "*****" if password.present?



        p.to_s

      rescue URI::InvalidURIError

        ""