Redact ?token= querystring parameter from GHES <3.8 archive URLs in logs

RELEASENOTES.md

@@ -1,2 +1,3 @@
 
-- Skip GitHub status checking on startup if environment variable `GEI_SKIP_STATUS_CHECK` is set to true.
+- Skip GitHub status checking on startup if environment variable `GEI_SKIP_STATUS_CHECK` is set to `true`
+- Redact `?token=` querystring parameter from GHES <3.8 archive URLs in logs

src/Octoshift/Services/OctoLogger.cs

@@ -3,6 +3,7 @@
 using System.IO;
 using System.Linq;
 using System.Net.Http;
+using System.Text.RegularExpressions;
 
 namespace OctoshiftCLI.Services;
 
@@ -30,6 +31,11 @@ public class OctoLogger
 
     private const string GENERIC_ERROR_MESSAGE = "An unexpected error happened. Please see the logs for details.";
 
+    private readonly HashSet<Regex> _redactionPatterns = new()
+    {
+        new Regex("\\b(?<=token=)(.+?)\\b")
+    };
+
     public OctoLogger()
     {
         var logStartTime = DateTime.Now;
@@ -88,6 +94,11 @@ private string MaskSecrets(string msg)
                 .Replace(Uri.EscapeDataString(secret), "***");
         }
 
+        foreach (var redactionPattern in _redactionPatterns)
+        {
+            result = redactionPattern.Replace(result, "***");
+        }
+
         return result;
     }
 

src/OctoshiftCLI.Tests/Octoshift/Services/OctoLoggerTests.cs

@@ -60,6 +60,32 @@ public void Secrets_Should_Be_Masked_From_Logs_And_Console()
         _consoleError.Should().NotContain(urlEncodedSecret);
     }
 
+    [Fact]
+    public void Ghes_Archive_Url_Tokens_Should_Be_Replaced_In_Logs_And_Console()
+    {
+
+        var ghesArchiveUrl = "https://files.github.acmeinc.com/foo?token=foobar";
+
+        _octoLogger.Verbose = false;
+        _octoLogger.LogInformation($"Archive URL: {ghesArchiveUrl}");
+        _octoLogger.LogVerbose($"Archive URL: {ghesArchiveUrl}");
+        _octoLogger.LogWarning($"Archive URL: {ghesArchiveUrl}");
+        _octoLogger.LogSuccess($"Archive URL: {ghesArchiveUrl}");
+        _octoLogger.LogError($"Archive URL: {ghesArchiveUrl}");
+        _octoLogger.LogError(new OctoshiftCliException("Archive URL: {ghesArchiveUrl}"));
+        _octoLogger.LogError(new InvalidOperationException("Archive URL: {ghesArchiveUrl}"));
+
+        _octoLogger.Verbose = true;
+        _octoLogger.LogVerbose("Archive URL: {ghesArchiveUrl}");
+
+        _consoleOutput.Should().NotContain(ghesArchiveUrl);
+        _logOutput.Should().NotContain(ghesArchiveUrl);
+        _verboseLogOutput.Should().NotContain(ghesArchiveUrl);
+        _consoleError.Should().NotContain(ghesArchiveUrl);
+
+        _consoleOutput.Should().Contain("Archive URL: https://files.github.acmeinc.com/foo?token=***");
+    }
+
     [Fact]
     public void LogError_For_OctoshiftCliException_Should_Log_Exception_Message_In_Non_Verbose_Mode()
     {