v0.1.1 — endpoint URLs never reach a log

A security fix, mirroring missivus-matomo v0.1.4. Reported against the Matomo plugin by @textagroup (Kirk Mayo) as missivus-matomo#1. Thank you.

Endpoint override URLs are no longer repeated back into errors, the log, or the admin notice

Endpoint::normalise() refused an unsafe MISSIVUS_GRAPH_BASE_URL / MISSIVUS_LOGIN_BASE_URL correctly, but ended its message with the rejected value verbatim — and that message was then logged by Mailer, attached to wp_mail_failed, and shown by the test-email screen, none of them with a final redaction pass.

So a base URL carrying credentials (https://user:password@host) or a token (?access_token=…) could reach the PHP error log and the WordPress admin. It needs a misconfiguration the site owner authored themselves, and both readers are already trusted surfaces — but it is a credential crossing a boundary it never needed to cross.

Fixed in three independent layers:

• Endpoint no longer assembles what it must not print. Every message is built from scheme, host, port and path only; userinfo, query string and fragment never enter a message at all. A value too malformed to parse, or a host name that fails validation, is reported by reason rather than by value.
• Redactor learned URL shapes — credentials inside a URL (anchored on ://, so an ordinary mailbox address is left alone), any name=value on the new Redactor::SECRET_PARAMS list (access_token, client_secret, code, password, signature, sas, …), and URL fragments.
• Mailer::redact() is now the single final pass on every string the mailer logs, hands to wp_mail_failed, or throws, and Admin\TestEmail applies the same pass to the admin notice.

The vendored transport under src/Vendor/Solvetus/Missivus/ is resynced from missivus-matomo v0.1.4 and remains byte-for-byte identical to it.

tests/Unit/EndpointRedactionTest.php adds eleven tests, two of which define a poisoned base-URL constant in their own PHP process and drive the real failure path — asserting the credential appears in neither the log, the wp_mail_failed payload, nor the admin notice, and that no HTTP request was built at all. 57 tests pass; PHPCS with WordPress-Coding-Standards clean; php -l and PHPCompatibilityWP clean at the 7.2 floor.

Full write-up as finding 3a in docs/SECURITY.md. Nothing to reconfigure on upgrade.

Install

Upload missivus-0.1.1.zip through Plugins → Add New → Upload Plugin, or wp plugin install missivus-0.1.1.zip --activate.