Skip to content

Commit

Permalink
Check that UpdateRepository#{inspect,to_s} don't leak sensitive info
Browse files Browse the repository at this point in the history
  • Loading branch information
imobachgs committed Feb 15, 2017
1 parent 0b6adb0 commit bb6ccf0
Show file tree
Hide file tree
Showing 2 changed files with 26 additions and 2 deletions.
12 changes: 10 additions & 2 deletions src/lib/installation/update_repository.rb
Expand Up @@ -269,8 +269,7 @@ def remote?
#
# @return [String] Debugging information
def inspect
safe_url = Yast::URL.HidePassword(uri.to_s)
"#<Installation::UpdateRepository> @uri=\"#{safe_url}\" @origin=#{@origin.inspect}"
"#<Installation::UpdateRepository> @uri=\"#{safe_uri}\" @origin=#{@origin.inspect}"
end

private
Expand Down Expand Up @@ -459,5 +458,14 @@ def init_progress
def update_progress(percent)
Yast::Progress.Step(percent)
end

# Returns the URI removing sensitive information
#
# @return [String] URI without the password (if present)
#
# @see Yast::URL.HidePassword
def safe_uri
@safe_uri ||= Yast::URL.HidePassword(uri.to_s)
end
end
end
16 changes: 16 additions & 0 deletions test/update_repository_test.rb
Expand Up @@ -295,4 +295,20 @@
end
end
end

describe "#inspect" do
let(:uri) { URI("http://user:123456@updates.suse.com") }

it "does not contain sensitive information" do
expect(repo.inspect).to_not include("123456")
end
end

describe "#to_s" do
let(:uri) { URI("http://user:123456@updates.suse.com") }

it "does not contain sensitive information" do
expect(repo.to_s).to_not include("123456")
end
end
end

0 comments on commit bb6ccf0

Please sign in to comment.