Repository: semantic-release/semantic-release (js)

Issue:
False positives with hide-sensitive [secure] output
## Current behavior

One example: the [toReplace function](https://github.com/semantic-release/semantic-release/blob/0ef52e7a5f4f4c2bc3daecf7d71eeb1323491374/lib/hide-sensitive.js#L6) will match on the env var [`GOPRIVATE`](https://golang.org/cmd/go/#hdr-Module_configuration_for_non_public_modules) when using semantic-release on Go projects with that setting configured.  `GOPRIVATE` will typically have the same hostname as `repositoryUrl` in internal corporate networks.

If `GOPRIVATE=host.com` and `repositoryUrl=https://host.com/owner/repo.git` for example, then this breaks the links generated in release notes and changelog:

```
# [1.1.0](https://[secure]/owner/repo/compare/v1.0.0...v1.1.0) (2020-05-19)

### Features

* my feature ([d6c2e99a](https://[secure]/owner/repo/commit/d6c2e99aa27324878e7068a2c84229738b483794))
f502ba0a

```



## Expected behavior

In this scenario, `host.com` should not be replaced with `[secure]`:

```
# [1.1.0](https://host.com/owner/repo/compare/v1.0.0...v1.1.0) (2020-05-19)

### Features

* my feature ([d6c2e99a](https://host.com/owner/repo/commit/d6c2e99aa27324878e7068a2c84229738b483794))
f502ba0a

```

## Environment

- **semantic-release** version: 17.0.7
- CI environment: hosted Gitlab
- Plugins used: commit-analyzer,release-notes-generator,exec,changelog,git,gitlab
- **semantic-release** configuration: <!-- link to your repository or relevant part of the semantic-release config -->
- CI logs: <!-- link to your CI logs or semantic-release logs -->


Pull request:
fix: prevent false positive secret replacement
Resolve #1558

Patch:
diff --git a/lib/hide-sensitive.js b/lib/hide-sensitive.js
index dea7345..6098496 100644
--- a/lib/hide-sensitive.js
+++ b/lib/hide-sensitive.js
@@ -2,9 +2,14 @@ const {escapeRegExp, size, isString} = require('lodash');
 const {SECRET_REPLACEMENT, SECRET_MIN_SIZE} = require('./definitions/constants');
 
 module.exports = (env) => {
-  const toReplace = Object.keys(env).filter(
-    (envVar) => /token|password|credential|secret|private/i.test(envVar) && size(env[envVar].trim()) >= SECRET_MIN_SIZE
-  );
+  const toReplace = Object.keys(env).filter((envVar) => {
+    // https://github.com/semantic-release/semantic-release/issues/1558
+    if (envVar === 'GOPRIVATE') {
+      return false;
+    }
+
+    return /token|password|credential|secret|private/i.test(envVar) && size(env[envVar].trim()) >= SECRET_MIN_SIZE;
+  });
 
   const regexp = new RegExp(toReplace.map((envVar) => escapeRegExp(env[envVar])).join('|'), 'g');
   return (output) =>


Test patch:
diff --git a/test/hide-sensitive.test.js b/test/hide-sensitive.test.js
index 0864e6d..2b319c4 100644
--- a/test/hide-sensitive.test.js
+++ b/test/hide-sensitive.test.js
@@ -19,6 +19,11 @@ test('Replace multiple occurences of sensitive environment variable values', (t)
   );
 });
 
+test('Replace sensitive environment variable matching specific regex for "private"', (t) => {
+  const env = {privateKey: 'secret', GOPRIVATE: 'host.com'};
+  t.is(hideSensitive(env)(`https://host.com?token=${env.privateKey}`), `https://host.com?token=${SECRET_REPLACEMENT}`);
+});
+
 test('Escape regexp special characters', (t) => {
   const env = {SOME_CREDENTIALS: 'p$^{.+}\\w[a-z]o.*rd'};
   t.is(
@@ -47,6 +52,11 @@ test('Exclude empty environment variables from the regexp if there is only empty
   t.is(hideSensitive({SOME_PASSWORD: '', SOME_TOKEN: ' \n '})(`https://host.com?token=`), 'https://host.com?token=');
 });
 
+test('Exclude nonsensitive GOPRIVATE environment variable for Golang projects from the regexp', (t) => {
+  const env = {GOPRIVATE: 'host.com'};
+  t.is(hideSensitive(env)(`https://host.com?token=`), 'https://host.com?token=');
+});
+
 test('Exclude environment variables with value shorter than SECRET_MIN_SIZE from the regexp', (t) => {
   const SHORT_TOKEN = repeat('a', SECRET_MIN_SIZE - 1);
   const LONG_TOKEN = repeat('b', SECRET_MIN_SIZE);