aws-actions/configure-aws-credentials
1
0
Fork 0
mirror of https://github.com/aws-actions/configure-aws-credentials.git synced 2026-09-03 06:05:04 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix: mask proxy URL credentials in job logs

Browse Source 
Basic-auth userinfo in the http-proxy input or HTTP(S)_PROXY environment
variables was never registered as a secret, so error messages carrying
the proxy URL printed the credentials unmasked in the job log.
This commit is contained in:
Tom Keller
2026-08-31 12:02:51 -07:00
parent 378a941623
commit a05dfa82bd
4 changed files with 63 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/helpers.test.ts
+23
View File
@@ -126,6 +126,29 @@ describe('Configure AWS Credentials helpers', {}, () => {
expect(core.exportVariable).toHaveBeenCalledWith('AWS_SESSION_TOKEN', '');
});
describe('maskProxyCredentials', {}, () => {
it('masks username and password embedded in a proxy URL', {}, () => {
helpers.maskProxyCredentials('http://user:secretpass@proxy.example.com:8080');
expect(core.setSecret).toHaveBeenCalledWith('user');
expect(core.setSecret).toHaveBeenCalledWith('secretpass');
});
it('masks both encoded and decoded forms of the credentials', {}, () => {
helpers.maskProxyCredentials('http://user:p%40ss@proxy.example.com:8080');
expect(core.setSecret).toHaveBeenCalledWith('p%40ss');
expect(core.setSecret).toHaveBeenCalledWith('p@ss');
});
it('masks the whole value even without embedded credentials or when unparseable', {}, () => {
helpers.maskProxyCredentials('http://proxy.example.com:8080');
expect(core.setSecret).toHaveBeenCalledWith('http://proxy.example.com:8080');
helpers.maskProxyCredentials('not a url');
expect(core.setSecret).toHaveBeenCalledWith('not a url');
// no username/password parts, so exactly one mask per call
expect(core.setSecret).toHaveBeenCalledTimes(2);
});
});
describe('validateAccountId', {}, () => {
it('enforces the allow-list even when the first element is empty', {}, () => {
expect(() => helpers.validateAccountId(['', '999999999999'], '111111111111')).toThrow(/does not match/);