Verified Commit ec61cf5f authored by Vitaly Slobodin's avatar Vitaly Slobodin 🔮
Browse files

fix(sanitizer): handle password clearing in URI

parent 6cb3c9bd
Loading
Loading
Loading
Loading
Loading
+8 −1
Original line number Diff line number Diff line
# frozen_string_literal: true

require "pg_query"
require "uri"

module Labkit
  module Logging
@@ -47,8 +48,14 @@ module Labkit
        #     URI::RFC2396_PARSER.parse('ssh://') => raise URI::InvalidURIError
        return "" if p.host.empty?

        p.password = "*****" if p.password.present?
        # Starting from v1.0.4, the `uri` gem clears the `password` instance variable
        # when the `user` setter is called. To preserve the current behavior,
        # we store the `password` in a temporary variable.
        password = p.password

        p.user = "*****" if p.user.present?
        p.password = "*****" if password.present?

        p.to_s
      rescue URI::InvalidURIError
        ""