Redact URI userinfo from settings names in Bundler User-Agent

The `options/` segment of Bundler's User-Agent is built from
`Bundler.settings.all`, which returns only setting names. Mirror
settings, however, embed a URI in the key itself
(`mirror.http://user:token@host/`), so the URI userinfo becomes part of
the name. That name is then sent to every gem source Bundler contacts,
including public or attacker-controlled sources, leaking the embedded
credentials cross-origin.

Strip the userinfo from any settings key that embeds a URI when building
the User-Agent, keeping the useful telemetry (which settings are in use
and the host) while dropping the secret. The redaction is limited to the
User-Agent; `Bundler.settings.all` still returns the real keys, which
`local_overrides` and `gem_mirrors` rely on.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hsbt

lib/bundler/fetcher.rb

@@ -215,7 +215,13 @@ def user_agent
           agent << " #{ruby.engine}/#{ruby.versions_string(engine_version)}"
         end
 
-        agent << " options/#{Bundler.settings.all.join(",")}"
+        # Some settings keys embed a URI (e.g. `mirror.<uri>`) whose userinfo can
+        # carry credentials. Strip the userinfo before advertising the setting
+        # names so we don't leak secrets to every gem source we talk to.
+        options = Bundler.settings.all.map do |key|
+          key.include?("://") ? key.gsub(%r{//[^/@]+@}, "//") : key
+        end
+        agent << " options/#{options.join(",")}"
 
         agent << " ci/#{cis.join(",")}" if cis.any?
 

spec/bundler/fetcher_spec.rb

@@ -141,6 +141,19 @@
       expect(fetcher.user_agent).to match(%r{options/foo,bar})
     end
 
+    it "strips userinfo from settings keys that embed a URI" do
+      allow(Bundler.settings).to receive(:all).and_return(
+        %w[foo mirror.http://user:token@example.org/ mirror.https://token@example.net/]
+      )
+      options = fetcher.user_agent.split(" ").find {|x| x.start_with?("options/") }
+
+      expect(options).not_to include("token")
+      expect(options).not_to include("user:")
+      expect(options).to include("mirror.http://example.org/")
+      expect(options).to include("mirror.https://example.net/")
+      expect(options).to include("foo")
+    end
+
     describe "include CI information" do
       it "from one CI" do
         with_env_vars("CI" => nil, "JENKINS_URL" => "foo") do