Mask different situations, malformed URL, encoded, decoded, raw signatures, nested parameters, and moved to a utility file

packages/cache/src/internal/shared/util.ts

@@ -0,0 +1,171 @@
+import {debug, setSecret} from '@actions/core'
+
+/**
+ * Masks the `sig` parameter in a URL and sets it as a secret.
+ * @param url The URL containing the `sig` parameter.
+ * @returns A masked URL where the sig parameter value is replaced with '***' if found,
+ *          or the original URL if no sig parameter is present.
+ */
+export function maskSigUrl(url: string): string {
+  if (!url) return url
+
+  try {
+    const rawSigRegex = /[?&](sig)=([^&=#]+)/gi
+    let match
+
+    while ((match = rawSigRegex.exec(url)) !== null) {
+      const rawSignature = match[2]
+      if (rawSignature) {
+        setSecret(rawSignature)
+      }
+    }
+
+    let parsedUrl: URL
+    try {
+      parsedUrl = new URL(url)
+    } catch {
+      try {
+        parsedUrl = new URL(url, 'https://example.com')
+      } catch (error) {
+        debug(`Failed to parse URL: ${url}`)
+        return maskSigWithRegex(url)
+      }
+    }
+
+    let masked = false
+    const paramNames = Array.from(parsedUrl.searchParams.keys())
+
+    for (const paramName of paramNames) {
+      if (paramName.toLowerCase() === 'sig') {
+        const signature = parsedUrl.searchParams.get(paramName)
+        if (signature) {
+          setSecret(signature)
+          setSecret(encodeURIComponent(signature))
+          parsedUrl.searchParams.set(paramName, '***')
+          masked = true
+        }
+      }
+    }
+    if (masked) {
+      return parsedUrl.toString()
+    }
+
+    if (/([:?&]|^)(sig)=([^&=#]+)/i.test(url)) {
+      return maskSigWithRegex(url)
+    }
+  } catch (error) {
+    debug(
+      `Error masking URL: ${
+        error instanceof Error ? error.message : String(error)
+      }`
+    )
+    return maskSigWithRegex(url)
+  }
+
+  return url
+}
+
+/**
+ * Fallback method to mask signatures using regex when URL parsing fails
+ */
+function maskSigWithRegex(url: string): string {
+  try {
+    const regex = /([:?&]|^)(sig)=([^&=#]+)/gi
+
+    return url.replace(regex, (fullMatch, prefix, paramName, value) => {
+      if (value) {
+        setSecret(value)
+        try {
+          setSecret(decodeURIComponent(value))
+        } catch {
+          // Ignore decoding errors
+        }
+        return `${prefix}${paramName}=***`
+      }
+      return fullMatch
+    })
+  } catch (error) {
+    debug(
+      `Error in maskSigWithRegex: ${
+        error instanceof Error ? error.message : String(error)
+      }`
+    )
+    return url
+  }
+}
+
+/**
+ * Masks any URLs containing signature parameters in the provided object
+ * Recursively searches through nested objects and arrays
+ */
+export function maskSecretUrls(
+  body: Record<string, unknown> | unknown[] | null
+): void {
+  if (typeof body !== 'object' || body === null) {
+    debug('body is not an object or is null')
+    return
+  }
+
+  type NestedValue =
+    | string
+    | number
+    | boolean
+    | null
+    | undefined
+    | NestedObject
+    | NestedArray
+  interface NestedObject {
+    [key: string]: NestedValue
+    signed_upload_url?: string
+    signed_download_url?: string
+  }
+  type NestedArray = NestedValue[]
+
+  const processUrl = (url: string): void => {
+    maskSigUrl(url)
+  }
+
+  const processObject = (
+    obj: Record<string, NestedValue> | NestedValue[]
+  ): void => {
+    if (typeof obj !== 'object' || obj === null) {
+      return
+    }
+
+    if (Array.isArray(obj)) {
+      for (const item of obj) {
+        if (typeof item === 'string') {
+          processUrl(item)
+        } else if (typeof item === 'object' && item !== null) {
+          processObject(item as Record<string, NestedValue> | NestedValue[])
+        }
+      }
+      return
+    }
+
+    if (
+      'signed_upload_url' in obj &&
+      typeof obj.signed_upload_url === 'string'
+    ) {
+      maskSigUrl(obj.signed_upload_url)
+    }
+    if (
+      'signed_download_url' in obj &&
+      typeof obj.signed_download_url === 'string'
+    ) {
+      maskSigUrl(obj.signed_download_url)
+    }
+
+    for (const key in obj) {
+      const value = obj[key]
+      if (typeof value === 'string') {
+        if (/([:?&]|^)(sig)=/i.test(value)) {
+          maskSigUrl(value)
+        }
+      } else if (typeof value === 'object' && value !== null) {
+        processObject(value as Record<string, NestedValue> | NestedValue[])
+      }
+    }
+  }
+  processObject(body as Record<string, NestedValue> | NestedValue[])
+}