Skip to content

Commit c56e01f

Browse files
dduzgun-securitydduzgun-security
authored
sec: bump go and xrepos + redact aws tokens in url (#604)
* sec: bump go and xrepos + redact aws tokens in url * go mod to 1.25.8 instead * go versions on the ci
1 parent b83a3c7 commit c56e01f

File tree

6 files changed

+105
-39
lines changed

6 files changed

+105
-39
lines changed

‎.github/workflows/go-getter.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@ jobs:
1717
strategy:
1818
matrix:
1919
go-version:
20-
- "1.24"
21-
- "1.25"
20+
- "1.25.8"
21+
- "1.26.1"
2222
steps:
2323
- name: Setup go
2424
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -62,8 +62,8 @@ jobs:
6262
strategy:
6363
matrix:
6464
go-version:
65-
- "1.24"
66-
- "1.25"
65+
- "1.25.8"
66+
- "1.26.1"
6767
steps:
6868
- name: Run git config # Windows-only
6969
run: git config --global core.autocrlf false
@@ -111,8 +111,8 @@ jobs:
111111
strategy:
112112
matrix:
113113
go-version:
114-
- "1.24"
115-
- "1.25"
114+
- "1.25.8"
115+
- "1.26.1"
116116
arch:
117117
- "386" # 32-bit x86
118118
- "arm" # 32-bit ARM
@@ -164,7 +164,7 @@ jobs:
164164
- name: Setup go
165165
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
166166
with:
167-
go-version: "1.25" # Use latest for linting
167+
go-version: "1.25.8" # Use latest for linting
168168

169169
- name: Setup cache for go modules
170170
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
@@ -190,8 +190,8 @@ jobs:
190190
strategy:
191191
matrix:
192192
go-version:
193-
- "1.24"
194-
- "1.25"
193+
- "1.25.8"
194+
- "1.26.1"
195195
permissions:
196196
id-token: write
197197
contents: read
@@ -257,8 +257,8 @@ jobs:
257257
strategy:
258258
matrix:
259259
go-version:
260-
- "1.24"
261-
- "1.25"
260+
- "1.25.8"
261+
- "1.26.1"
262262
permissions:
263263
id-token: write
264264
contents: read

‎.go-version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.24.6
1+
1.25.8

‎go.mod‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ require (
1515
github.com/klauspost/compress v1.18.4
1616
github.com/mitchellh/go-homedir v1.1.0
1717
github.com/ulikunitz/xz v0.5.15
18-
golang.org/x/oauth2 v0.35.0
19-
golang.org/x/sys v0.41.0
18+
golang.org/x/oauth2 v0.36.0
19+
golang.org/x/sys v0.42.0
2020
google.golang.org/api v0.267.0
2121
)
2222

@@ -69,11 +69,11 @@ require (
6969
go.opentelemetry.io/otel/sdk v1.40.0 // indirect
7070
go.opentelemetry.io/otel/sdk/metric v1.40.0 // indirect
7171
go.opentelemetry.io/otel/trace v1.40.0 // indirect
72-
golang.org/x/crypto v0.47.0 // indirect
73-
golang.org/x/net v0.49.0 // indirect
74-
golang.org/x/sync v0.19.0 // indirect
75-
golang.org/x/text v0.33.0 // indirect
76-
golang.org/x/time v0.14.0 // indirect
72+
golang.org/x/crypto v0.48.0 // indirect
73+
golang.org/x/net v0.51.0 // indirect
74+
golang.org/x/sync v0.20.0 // indirect
75+
golang.org/x/text v0.34.0 // indirect
76+
golang.org/x/time v0.15.0 // indirect
7777
google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
7878
google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 // indirect
7979
google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 // indirect
@@ -82,4 +82,4 @@ require (
8282
gopkg.in/cheggaaa/pb.v1 v1.0.27 // indirect
8383
)
8484

85-
go 1.24.6
85+
go 1.25.8

‎go.sum‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -155,20 +155,20 @@ go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4A
155155
go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg=
156156
go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw=
157157
go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA=
158-
golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
159-
golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
160-
golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
161-
golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
162-
golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
163-
golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
164-
golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
165-
golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
166-
golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
167-
golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
168-
golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
169-
golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
170-
golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
171-
golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
158+
golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
159+
golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
160+
golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
161+
golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
162+
golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
163+
golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
164+
golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
165+
golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
166+
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
167+
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
168+
golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
169+
golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
170+
golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
171+
golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
172172
gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
173173
gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
174174
google.golang.org/api v0.267.0 h1:w+vfWPMPYeRs8qH1aYYsFX68jMls5acWl/jocfLomwE=

‎url.go‎

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,21 @@ package getter
55

66
import "net/url"
77

8+
// redactedParams is the list of URL query parameter names whose values are
9+
// sensitive and must be replaced with "redacted" in error messages and logs.
10+
var redactedParams = []string{
11+
"sshkey",
12+
"aws_access_key_id",
13+
"aws_access_key_secret",
14+
"aws_access_token",
15+
}
16+
817
// RedactURL is a port of url.Redacted from the standard library,
918
// which is like url.String but replaces any password with "redacted".
1019
// Only the password in u.URL is redacted. This allows the library
1120
// to maintain compatibility with go1.14.
12-
// This port was also extended to redact all "sshkey" from URL query parameter
21+
// This port was also extended to redact sensitive URL query parameters
22+
// (sshkey, aws_access_key_id, aws_access_key_secret, aws_access_token)
1323
// and replace them with "redacted".
1424
func RedactURL(u *url.URL) string {
1525
if u == nil {
@@ -21,11 +31,17 @@ func RedactURL(u *url.URL) string {
2131
ru.User = url.UserPassword(ru.User.Username(), "redacted")
2232
}
2333
q := ru.Query()
24-
if q.Has("sshkey") {
25-
values := q["sshkey"]
26-
for i := range values {
27-
values[i] = "redacted"
34+
modified := false
35+
for _, param := range redactedParams {
36+
if q.Has(param) {
37+
values := q[param]
38+
for i := range values {
39+
values[i] = "redacted"
40+
}
41+
modified = true
2842
}
43+
}
44+
if modified {
2945
ru.RawQuery = q.Encode()
3046
}
3147
return ru.String()

‎url_test.go‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,56 @@ func TestRedactURL(t *testing.T) {
129129
},
130130
want: "ssh://git@github.com/hashicorp/go-getter-test-private.git?sshkey=redacted&sshkey=redacted",
131131
},
132+
{
133+
name: "S3 URL with aws_access_key_id",
134+
url: &url.URL{
135+
Scheme: "s3",
136+
Host: "bucket.s3.amazonaws.com",
137+
Path: "/key",
138+
RawQuery: "aws_access_key_id=AKIAIOSFODNN7EXAMPLE",
139+
},
140+
want: "s3://bucket.s3.amazonaws.com/key?aws_access_key_id=redacted",
141+
},
142+
{
143+
name: "S3 URL with aws_access_key_secret",
144+
url: &url.URL{
145+
Scheme: "s3",
146+
Host: "bucket.s3.amazonaws.com",
147+
Path: "/key",
148+
RawQuery: "aws_access_key_secret=wJalrXUtnFEMI%2FK7MDENG%2FbPxRfiCYEXAMPLEKEY",
149+
},
150+
want: "s3://bucket.s3.amazonaws.com/key?aws_access_key_secret=redacted",
151+
},
152+
{
153+
name: "S3 URL with aws_access_token",
154+
url: &url.URL{
155+
Scheme: "s3",
156+
Host: "bucket.s3.amazonaws.com",
157+
Path: "/key",
158+
RawQuery: "aws_access_token=AQoXnyc4lcK4w",
159+
},
160+
want: "s3://bucket.s3.amazonaws.com/key?aws_access_token=redacted",
161+
},
162+
{
163+
name: "S3 URL with all three AWS credential params",
164+
url: &url.URL{
165+
Scheme: "s3",
166+
Host: "bucket.s3.amazonaws.com",
167+
Path: "/key",
168+
RawQuery: "aws_access_key_id=AKID&aws_access_key_secret=SECRET&aws_access_token=TOKEN",
169+
},
170+
want: "s3://bucket.s3.amazonaws.com/key?aws_access_key_id=redacted&aws_access_key_secret=redacted&aws_access_token=redacted",
171+
},
172+
{
173+
name: "S3 URL with AWS credentials and non-sensitive params preserved",
174+
url: &url.URL{
175+
Scheme: "s3",
176+
Host: "bucket.s3.amazonaws.com",
177+
Path: "/key",
178+
RawQuery: "aws_access_key_id=AKID&aws_access_key_secret=SECRET&region=us-east-1",
179+
},
180+
want: "s3://bucket.s3.amazonaws.com/key?aws_access_key_id=redacted&aws_access_key_secret=redacted&region=us-east-1",
181+
},
132182
}
133183

134184
for _, tt := range cases {

0 commit comments

Comments
 (0)