fix: mask proxy URL credentials in job logs

Basic-auth userinfo in the http-proxy input or HTTP(S)_PROXY environment
variables was never registered as a secret, so error messages carrying
the proxy URL printed the credentials unmasked in the job log.

src/CredentialsClient.ts

@@ -4,7 +4,7 @@ import { defaultProvider } from '@aws-sdk/credential-provider-node';
 import type { AwsCredentialIdentity } from '@aws-sdk/types';
 import { NodeHttpHandler } from '@smithy/node-http-handler';
 import { ProxyAgent } from 'proxy-agent';
-import { buildCustomUserAgent, errorMessage, getCallerIdentity } from './helpers';
+import { buildCustomUserAgent, errorMessage, getCallerIdentity, maskProxyCredentials } from './helpers';
 import { ProxyResolver } from './ProxyResolver';
 
 if (!process.env.AWS_EXECUTION_ENV) {
@@ -32,6 +32,7 @@ export class CredentialsClient {
     }
     if (props.proxyServer) {
       info('Configuring proxy handler for STS client');
+      maskProxyCredentials(props.proxyServer);
       const proxyOptions: { httpProxy: string; httpsProxy: string; noProxy?: string } = {
         httpProxy: props.proxyServer,
         httpsProxy: props.proxyServer,

src/helpers.ts

@@ -193,6 +193,29 @@ export function toCredentialIdentity(creds?: Partial<Credentials>): AwsCredentia
   };
 }
 
+// Registers any userinfo embedded in a proxy URL as secrets so it is masked in job logs.
+// First the literal proxy string, then any username/password components if parseable.
+// If the username/password is percent-encoded, the decoded form is also masked.
+export function maskProxyCredentials(proxyServer: string): void {
+  core.setSecret(proxyServer);
+  let url: URL;
+  try {
+    url = new URL(proxyServer);
+  } catch (_) {
+    return;
+  }
+  for (const part of [url.username, url.password]) {
+    if (!part) continue;
+    core.setSecret(part);
+    try {
+      const decoded = decodeURIComponent(part);
+      if (decoded !== part) core.setSecret(decoded);
+    } catch (_) {
+      // malformed percent-encoding; the raw form is already masked
+    }
+  }
+}
+
 // Tags have a more restrictive set of acceptable characters than GitHub environment variables can.
 // This replaces anything not conforming to the tag restrictions by inverting the regular expression.
 // See the AWS documentation for constraint specifics https://docs.aws.amazon.com/STS/latest/APIReference/API_Tag.html.