chore: redadct url param secrets in logs

internal/notif/client.go

@@ -1,6 +1,7 @@
 package notif
 
 import (
+	"regexp"
 	"strings"
 
 	"github.com/crazy-max/diun/v4/internal/model"
@@ -107,11 +108,22 @@ func (c *Client) Send(entry model.NotifEntry) {
 	for _, n := range c.notifiers {
 		log.Debug().Str("image", entry.Image.String()).Msgf("Sending %s notification...", n.Name())
 		if err := n.Send(entry); err != nil {
-			log.Error().Err(err).Str("image", entry.Image.String()).Msgf("%s notification failed", strings.Title(n.Name())) //nolint:staticcheck // ignoring "SA1019: strings.Title is deprecated", as for our use we don't need full unicode support
+			log.Error().Str("image", entry.Image.String()).Msgf("%s notification failed: %s", strings.Title(n.Name()), SanitizeUrlTokens(err)) //nolint:staticcheck // ignoring "SA1019: strings.Title is deprecated", as for our use we don't need full unicode support
 		}
 	}
 }
 
+// SanitizeUrlTokens redacts auth tokens in URLs from error messages
+func SanitizeUrlTokens(err error) string {
+	if err == nil {
+		return ""
+	}
+	params := []string{"token", "apikey", "api_key", "access_token", "auth", "authorization", "jwt", "sessionid", "session_id", "password", "secret", "key", "code"}
+	pattern := `([?&](` + strings.Join(params, "|") + `)=)[^&"\s]+` // scan ? or & followed by one of the param names and =, then redact until &, whitespace, or " (end of URL)
+	re := regexp.MustCompile(pattern)
+	return re.ReplaceAllString(err.Error(), `$1[REDACTED]`) // leave param name, redact secret value
+}
+
 // List returns created notifiers
 func (c *Client) List() []notifier.Notifier {
 	return c.notifiers

internal/notif/client_test.go

@@ -0,0 +1,45 @@
+package notif
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestSanitizeUrlTokens(t *testing.T) {
+	tests := []struct {
+		input    error
+		expected string
+	}{
+		{
+			input:    errors.New(`Post "http://gotify:9265/message?token=supersecret": dial tcp ...`),
+			expected: `Post "http://gotify:9265/message?token=[REDACTED]": dial tcp ...`,
+		},
+		{
+			input:    errors.New(`GET /api?apikey=12345&auth=abcdef`),
+			expected: `GET /api?apikey=[REDACTED]&auth=[REDACTED]`,
+		},
+		{
+			input:    errors.New(`https://foo.com?token=abc&apikey=def&password=ghi`),
+			expected: `https://foo.com?token=[REDACTED]&apikey=[REDACTED]&password=[REDACTED]`,
+		},
+		{
+			input:    errors.New(`https://bar.com?sessionid=xyz&key=123`),
+			expected: `https://bar.com?sessionid=[REDACTED]&key=[REDACTED]`,
+		},
+		{
+			input:    errors.New(`No sensitive params here`),
+			expected: `No sensitive params here`,
+		},
+		{
+			input:    errors.New(`Post "http://gotify:9265/message?otherparam=asdf": dial tcp ...`),
+			expected: `Post "http://gotify:9265/message?otherparam=asdf": dial tcp ...`,
+		},
+	}
+
+	for _, tt := range tests {
+		result := SanitizeUrlTokens(tt.input)
+		if result != tt.expected {
+			t.Errorf("SanitizeUrlTokens(%q) = %q; want %q", tt.input.Error(), result, tt.expected)
+		}
+	}
+}