85 lines
3.1 KiB
Diff
85 lines
3.1 KiB
Diff
|
From 1a3445769d0a3c392487ec9480c0bfad07bde063 Mon Sep 17 00:00:00 2001
|
||
|
|
From: =?UTF-8?q?Dan=20=C4=8Cerm=C3=A1k?= <dcermak@suse.com>
|
||
|
|
Date: Sun, 30 Jun 2024 16:09:52 +0200
|
||
|
|
Subject: [PATCH] Backport fix for CVE-2024-6104
|
||
|
|
|
||
|
|
This is https://github.com/hashicorp/go-retryablehttp/pull/158 only directly
|
||
|
|
applied to the vendor/ source tree
|
||
|
|
See also https://github.com/advisories/GHSA-v6v8-xj6m-xwqh
|
||
|
|
---
|
||
|
|
.../hashicorp/go-retryablehttp/client.go | 28 ++++++++++++++-----
|
||
|
|
1 file changed, 21 insertions(+), 7 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/vendor/github.com/hashicorp/go-retryablehttp/client.go b/vendor/github.com/hashicorp/go-retryablehttp/client.go
|
||
|
|
index 12ac50bcc..efee53c40 100644
|
||
|
|
--- a/vendor/github.com/hashicorp/go-retryablehttp/client.go
|
||
|
|
+++ b/vendor/github.com/hashicorp/go-retryablehttp/client.go
|
||
|
|
@@ -658,9 +658,9 @@ func (c *Client) Do(req *Request) (*http.Response, error) {
|
||
|
|
if logger != nil {
|
||
|
|
switch v := logger.(type) {
|
||
|
|
case LeveledLogger:
|
||
|
|
- v.Debug("performing request", "method", req.Method, "url", req.URL)
|
||
|
|
+ v.Debug("performing request", "method", req.Method, "url", redactURL(req.URL))
|
||
|
|
case Logger:
|
||
|
|
- v.Printf("[DEBUG] %s %s", req.Method, req.URL)
|
||
|
|
+ v.Printf("[DEBUG] %s %s", req.Method, redactURL(req.URL))
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
@@ -715,9 +715,9 @@ func (c *Client) Do(req *Request) (*http.Response, error) {
|
||
|
|
if err != nil {
|
||
|
|
switch v := logger.(type) {
|
||
|
|
case LeveledLogger:
|
||
|
|
- v.Error("request failed", "error", err, "method", req.Method, "url", req.URL)
|
||
|
|
+ v.Error("request failed", "error", err, "method", req.Method, "url", redactURL(req.URL))
|
||
|
|
case Logger:
|
||
|
|
- v.Printf("[ERR] %s %s request failed: %v", req.Method, req.URL, err)
|
||
|
|
+ v.Printf("[ERR] %s %s request failed: %v", req.Method, redactURL(req.URL), err)
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
// Call this here to maintain the behavior of logging all requests,
|
||
|
|
@@ -753,7 +753,7 @@ func (c *Client) Do(req *Request) (*http.Response, error) {
|
||
|
|
|
||
|
|
wait := c.Backoff(c.RetryWaitMin, c.RetryWaitMax, i, resp)
|
||
|
|
if logger != nil {
|
||
|
|
- desc := fmt.Sprintf("%s %s", req.Method, req.URL)
|
||
|
|
+ desc := fmt.Sprintf("%s %s", req.Method, redactURL(req.URL))
|
||
|
|
if resp != nil {
|
||
|
|
desc = fmt.Sprintf("%s (status: %d)", desc, resp.StatusCode)
|
||
|
|
}
|
||
|
|
@@ -818,11 +818,11 @@ func (c *Client) Do(req *Request) (*http.Response, error) {
|
||
|
|
// communicate why
|
||
|
|
if err == nil {
|
||
|
|
return nil, fmt.Errorf("%s %s giving up after %d attempt(s)",
|
||
|
|
- req.Method, req.URL, attempt)
|
||
|
|
+ req.Method, redactURL(req.URL), attempt)
|
||
|
|
}
|
||
|
|
|
||
|
|
return nil, fmt.Errorf("%s %s giving up after %d attempt(s): %w",
|
||
|
|
- req.Method, req.URL, attempt, err)
|
||
|
|
+ req.Method, redactURL(req.URL), attempt, err)
|
||
|
|
}
|
||
|
|
|
||
|
|
// Try to read the response body so we can reuse this connection.
|
||
|
|
@@ -903,3 +903,17 @@ func (c *Client) StandardClient() *http.Client {
|
||
|
|
Transport: &RoundTripper{Client: c},
|
||
|
|
}
|
||
|
|
}
|
||
|
|
+
|
||
|
|
+// Taken from url.URL#Redacted() which was introduced in go 1.15.
|
||
|
|
+// We can switch to using it directly if we'll bump the minimum required go version.
|
||
|
|
+func redactURL(u *url.URL) string {
|
||
|
|
+ if u == nil {
|
||
|
|
+ return ""
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
+ ru := *u
|
||
|
|
+ if _, has := ru.User.Password(); has {
|
||
|
|
+ ru.User = url.UserPassword(ru.User.Username(), "xxxxx")
|
||
|
|
+ }
|
||
|
|
+ return ru.String()
|
||
|
|
+}
|
||
|
|
--
|
||
|
|
2.45.2
|
||
|
|
|