mirror of
https://github.com/semantic-release/semantic-release.git
synced 2026-10-25 15:39:35 +00:00
Gregor Martynus
f293647392
* fix: ensure percent-encoded secrets get masked Co-authored-by: Gregor Martynus <39992+gr2m@users.noreply.github.com> * fix: mask secrets in the exact form url.format() embeds them in git URLs The authenticated repository URL is built with the legacy url.format(), which encodes the auth field like encodeURIComponent() except that ":" separators are kept as is. A GIT_CREDENTIALS value such as "user:abc@def-secret" therefore appears as "user:abc%40def-secret" in a failing git command, a form matched by neither the raw value, encodeURI(), nor encodeURIComponent() candidates, and leaked unmasked. Add the colon-preserving encoded form to the redaction candidates, assert the unit tests against URLs built the same way get-git-auth-url.js builds them, and add an integration test reproducing the leak end-to-end with a git remote on a closed loopback port. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Matt Travi <programmer@travi.org> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>