Files
renovate/lib/proxy.spec.ts
T
Jamie Tanna f88212be2e fix(proxy): sanitise password components in HTTP_PROXY variable(s) in logs (#45117)
If a proxy URL appears to have a password component in it, we should
make sure that this is sanitised.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
2026-08-06 15:16:06 +00:00

94 lines
2.9 KiB
TypeScript

import { bootstrap, hasProxy } from './proxy.ts';
import * as sanitize from './util/sanitize.ts';
const addSecretForSanitizing = vi.spyOn(sanitize, 'addSecretForSanitizing');
describe('proxy', () => {
const httpProxy = 'http://example.org/http-proxy';
const httpsProxy = 'http://example.org/https-proxy';
const noProxy = 'http://example.org/no-proxy';
beforeEach(() => {
delete process.env.HTTP_PROXY;
delete process.env.http_proxy;
delete process.env.HTTPS_PROXY;
delete process.env.https_proxy;
delete process.env.NO_PROXY;
delete process.env.no_proxy;
});
it('respects HTTP_PROXY', () => {
process.env.HTTP_PROXY = httpProxy;
bootstrap();
expect(hasProxy()).toBeTrue();
});
it('copies upper case HTTP_PROXY to http_proxy', () => {
process.env.HTTP_PROXY = httpProxy;
bootstrap();
expect(hasProxy()).toBeTrue();
expect(process.env.HTTP_PROXY).toBeDefined();
expect(process.env.http_proxy).toBeDefined();
expect(process.env.HTTPS_PROXY).toBeUndefined();
expect(process.env.https_proxy).toBeUndefined();
expect(process.env.NO_PROXY).toBeUndefined();
expect(process.env.no_proxy).toBeUndefined();
});
it('respects HTTPS_PROXY', () => {
process.env.HTTPS_PROXY = httpsProxy;
bootstrap();
expect(hasProxy()).toBeTrue();
});
it('copies upper case HTTPS_PROXY to https_proxy', () => {
process.env.HTTPS_PROXY = httpsProxy;
bootstrap();
expect(hasProxy()).toBeTrue();
expect(process.env.HTTPS_PROXY).toBeDefined();
expect(process.env.https_proxy).toBeDefined();
expect(process.env.HTTP_PROXY).toBeUndefined();
expect(process.env.http_proxy).toBeUndefined();
expect(process.env.NO_PROXY).toBeUndefined();
expect(process.env.no_proxy).toBeUndefined();
});
it('does nothing', () => {
process.env.no_proxy = noProxy;
bootstrap();
expect(hasProxy()).toBeFalse();
});
it('sanitizes password from HTTP_PROXY credentials', () => {
process.env.HTTP_PROXY = 'http://user:s3cr3t@example.org';
bootstrap();
expect(addSecretForSanitizing).toHaveBeenCalledWith('s3cr3t', 'global');
});
it('sanitizes password from HTTPS_PROXY credentials', () => {
process.env.HTTPS_PROXY = 'http://user:s3cr3t@example.org';
bootstrap();
expect(addSecretForSanitizing).toHaveBeenCalledWith('s3cr3t', 'global');
});
it('does not sanitize username-only proxy credentials', () => {
process.env.HTTP_PROXY = 'http://user@example.org';
bootstrap();
expect(addSecretForSanitizing).not.toHaveBeenCalled();
});
it('sanitizes password-only proxy credentials', () => {
process.env.HTTP_PROXY = 'http://:s3cr3t@example.org';
bootstrap();
expect(addSecretForSanitizing).toHaveBeenCalledWith('s3cr3t', 'global');
});
it('does not sanitize when proxy has no credentials', () => {
process.env.HTTP_PROXY = httpProxy;
bootstrap();
expect(addSecretForSanitizing).not.toHaveBeenCalled();
});
});