harden: strip userinfo from the URL that auth whoami prints #608

New issue

Closed

opened 2026-09-23 15:43:41 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-23 15:43:41 +00:00

Owner

What

auth whoami prints the resolved forge URL as it is (internal/cmd/auth/whoami.go:115). The URL comes from GetCredentialsWithSource, which returns MADTEA_URL or madtea.url without change. A hand-set URL that carries user:secret@host is then printed into the terminal or a transcript. The token line is masked, but this URL is not.

Fix

Print the URL with its userinfo removed, the same way RequireSecureScheme builds its error text (safe.User = nil). Apply the same to every other place in whoami that prints a resolved URL.

Acceptance

auth whoami with MADTEA_URL=https://user:secret@forge.example.com prints https://forge.example.com and never prints secret.
A test locks this, and the gate is green.

## What `auth whoami` prints the resolved forge URL as it is (`internal/cmd/auth/whoami.go:115`). The URL comes from `GetCredentialsWithSource`, which returns `MADTEA_URL` or `madtea.url` without change. A hand-set URL that carries `user:secret@host` is then printed into the terminal or a transcript. The token line is masked, but this URL is not. ## Fix Print the URL with its userinfo removed, the same way `RequireSecureScheme` builds its error text (`safe.User = nil`). Apply the same to every other place in `whoami` that prints a resolved URL. ## Acceptance - `auth whoami` with `MADTEA_URL=https://user:secret@forge.example.com` prints `https://forge.example.com` and never prints `secret`. - A test locks this, and the gate is green.

hexajon added the

security

severity/low

labels

2026-09-23 15:43:41 +00:00

hexajon referenced this issue from a pull request that will close it,

2026-09-23 16:38:52 +00:00

fix(auth): strip userinfo from the URLs that whoami prints #612

hexajon referenced this issue from a commit

2026-09-23 16:38:52 +00:00

fix(auth): strip userinfo from the URLs that whoami prints

hexajon closed this issue