From 53b4a9893ab355c91454be211283f708199b2666 Mon Sep 17 00:00:00 2001 From: localhost41 Date: Thu, 9 Jul 2026 17:44:12 -0700 Subject: [PATCH] Redact URL userinfo in qvac-bench errors --- src/cli.ts | 1 + test/index.test.ts | 24 ++++++++++++++++++++++++ 2 files changed, 25 insertions(+) diff --git a/src/cli.ts b/src/cli.ts index 9323f83..22eab82 100644 --- a/src/cli.ts +++ b/src/cli.ts @@ -423,6 +423,7 @@ function safeEndpointLabel(url: string): string { function sanitizeErrorMessage(message: string): string { return message + .replace(/(https?:\/\/)([^/@\s]+)@/gi, "$1@") .replace(/authorization:\s*bearer\s+[^\s,;]+/gi, "authorization: Bearer ") .replace(/bearer\s+[^\s,;]+/gi, "Bearer ") .replace(/(api[-_]?key|authorization|auth|password|secret|token)=([^&\s]+)/gi, "$1="); diff --git a/test/index.test.ts b/test/index.test.ts index 1cd8962..489fb62 100644 --- a/test/index.test.ts +++ b/test/index.test.ts @@ -603,6 +603,30 @@ describe("qvac-bench", () => { expect(result.stderr).not.toContain("url-secret"); }); + it("redacts URL userinfo from underlying fetch errors", async () => { + vi.stubGlobal( + "fetch", + vi.fn(async () => { + throw new Error( + "Request cannot be constructed from a URL that includes credentials: http://user:pass@127.0.0.1:8000/v1/chat/completions?api_key=url-secret" + ); + }) + ); + + const result = await runCli([ + "--url", + "http://user:pass@127.0.0.1:8000/v1/chat/completions?api_key=url-secret", + "--api-key", + "secret-token" + ]); + + expect(result.exitCode).toBe(1); + expect(result.stderr).toContain("http://@127.0.0.1:8000/v1/chat/completions?api_key="); + expect(result.stderr).not.toContain("user:pass"); + expect(result.stderr).not.toContain("url-secret"); + expect(result.stderr).not.toContain("secret-token"); + }); + it("reports non-2xx endpoint responses distinctly", async () => { const result = await runCli( ["--url", "http://localhost:8000/v1/chat/completions", "--api-key", "secret-token"],