Merge PR #696: fleetd #692 — bound the unbounded userinfo mask in redact()

scripts/config-edit.sh

@@ -213,6 +213,17 @@ map_masked_lines() {
   done < "$file"
 }
 
+# Masks every `scheme://user:pass@host` userinfo on one line of text, replacing just that
+# userinfo with `<redacted>` and leaving the rest of the line untouched, byte for byte. The
+# pattern stops at the first `/`, whitespace, or `@` reached after `://` — a URI's userinfo
+# component cannot contain any of those three characters — so a URI with no userinfo, followed
+# later on the same line by an unrelated `@`, never matches. The `g` flag matters: a line can
+# carry more than one URI. Shared by every caller that prints a line which may hold a
+# credentialed URI, so the bound lives in exactly one place.
+mask_url_userinfo() {
+  printf '%s\n' "$1" | sed -E 's#://[^@/[:space:]]*@#://<redacted>@#g'
+}
+
 redact() {
   local old_file="$1" new_file="$2"
   local line prefix content indent lead key old_line=0 new_line=0 in_hunk=0
@@ -270,7 +281,7 @@ redact() {
         continue
       fi
     fi
-    printf '%s\n' "$line" | sed -E 's#://[^@]*@#://<redacted>@#g'
+    mask_url_userinfo "$line"
   done
   [ "$saved_nocasematch" = 1 ] || shopt -u nocasematch
 }
@@ -583,7 +594,7 @@ install_candidate() {
 # Masks basic-auth userinfo (scheme://user:pass@host) in a daemon verdict line before it reaches
 # the terminal.
 mask_verdict_userinfo() {
-  printf '%s\n' "$1" | sed -E 's#://[^@/[:space:]]*@#://<redacted>@#g'
+  mask_url_userinfo "$1"
 }
 
 # Prints the literal command the operator (or a test) can run to restore the backup by hand — the

scripts/test-config-edit.sh

@@ -233,6 +233,66 @@ test_redaction_holds() {
   assert_contains "weight" "$RUN_OUTPUT" "a diff must have been demonstrably printed at all"
 }
 
+# redact()'s key-name filter only inspects the KEY, so a diff line whose key does not match
+# TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|CREDENTIAL|URI|_KEY still reaches the final userinfo
+# sed even when its VALUE holds a credentialed URI. "note" is not a sensitive key name, so this
+# line must fall all the way through to that sed, not the earlier whole-value branch. The
+# trailing prose on both sides of the userinfo is a positive control: it proves the line reached
+# the userinfo sed (which touches only the userinfo) rather than the earlier branch (which would
+# have replaced the whole value with a bare "<redacted>" and dropped the prose).
+test_diff_line_userinfo_is_masked_with_positive_control() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.note=see amqp://alice:wonderland@rabbit.local:5672/vhost for details'
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "diff-userinfo-case reload exit code"
+  assert_not_contains "alice:wonderland" "$RUN_OUTPUT" "the userinfo must never reach the output"
+  assert_contains "amqp://<redacted>@rabbit.local:5672/vhost" "$RUN_OUTPUT" \
+    "the userinfo must be MASKED, not deleted — the rest of the value must survive"
+  assert_contains "note:" "$RUN_OUTPUT" "the key name must still reach the output"
+  assert_contains "see " "$RUN_OUTPUT" "prose BEFORE the userinfo must still reach the output"
+  assert_contains "for details" "$RUN_OUTPUT" "prose AFTER the userinfo must still reach the output"
+}
+
+# A diff line can hold a URL with no userinfo, followed later on the same line by an unrelated @
+# (free text in a string value, for example an email address). The line must pass through the
+# userinfo sed byte for byte: the match must stop at the end of the URL and must not treat the
+# later @ as a second userinfo delimiter.
+test_diff_line_uri_without_userinfo_survives_a_later_at_sign() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.note2=see https://docs.local/guide and mail ops@example.com'
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "diff-no-userinfo-with-later-at-sign reload exit code"
+  assert_contains "note2: see https://docs.local/guide and mail ops@example.com" "$RUN_OUTPUT" \
+    "a URL with no userinfo plus a later @ on the same line must pass through byte for byte"
+}
+
+# Two credentialed URIs on one diff line must both be masked — the g flag matters.
+test_diff_line_masks_multiple_userinfo_with_g_flag() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.note3=amqp://u1:p1@host1/vhost1 and amqp://u2:p2@host2/vhost2'
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "diff-two-userinfo-on-one-line reload exit code"
+  assert_not_contains "u1:p1" "$RUN_OUTPUT" "the first userinfo must never reach the output"
+  assert_not_contains "u2:p2" "$RUN_OUTPUT" "the second userinfo must never reach the output"
+  assert_contains "amqp://<redacted>@host1/vhost1" "$RUN_OUTPUT" "the first URI must be masked"
+  assert_contains "amqp://<redacted>@host2/vhost2" "$RUN_OUTPUT" "the second URI must be masked"
+}
+
 # ------------------------------------------------------- acceptance criterion 9: forgotten value
 # `--set .a.b=` is a plausible typo (the value simply forgotten), and it must be refused outright
 # rather than silently nulling the field — a null numeric field falls back to its default, which
@@ -753,6 +813,12 @@ echo "== acceptance criterion 6: the marker works =="
 test_marker_skips_lines_before_it
 echo "== acceptance criterion 7 (+13: redaction is proven to have run) =="
 test_redaction_holds
+echo "== fleetd #692: a diff line's userinfo is masked, rest of the value survives =="
+test_diff_line_userinfo_is_masked_with_positive_control
+echo "== fleetd #692: a diff line's URI with no userinfo survives a later @ in the line =="
+test_diff_line_uri_without_userinfo_survives_a_later_at_sign
+echo "== fleetd #692: two userinfo URIs on one diff line are both masked =="
+test_diff_line_masks_multiple_userinfo_with_g_flag
 echo "== acceptance criterion 9: a forgotten value refuses and installs nothing =="
 test_forgotten_value_refuses_and_installs_nothing
 echo "== acceptance criterion 10: an explicit clear writes a bare null =="