CVE-2022-29810: Insertion of Sensitive Information into Log File (CWE-532)
value: The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 5.5
Published: 2022-04-27T06:15Z
Repository: https://github.com/hashicorp/go-getter
Language: Go
Files changed: .gitignore, url.go, url_test.go
Commit date: 2022-01-03 11:22:04 +0100
Commit message: Redact SSH key from URL query parameter

Signed-off-by: Guilherme Macedo <guilherme.macedo@suse.com>

Diff: diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..511ca26
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+cmd/go-getter/go-getter
diff --git a/url.go b/url.go
index 1eaa4ce..98b73da 100644
--- a/url.go
+++ b/url.go
@@ -11,9 +11,14 @@ func RedactURL(u *url.URL) string {
 		return ""
 	}
 
 	ru := *u
 	if _, has := ru.User.Password(); has {
-		ru.User = url.UserPassword(ru.User.Username(), "xxxxx")
+		ru.User = url.UserPassword(ru.User.Username(), "redacted")
+	}
+	q := ru.Query()
+	if q.Get("sshkey") != "" {
+		q.Set("sshkey", "redacted")
+		ru.RawQuery = q.Encode()
 	}
 	return ru.String()
 }
diff --git a/url_test.go b/url_test.go
index 3f87b0d..720359e 100644
--- a/url_test.go
+++ b/url_test.go
@@ -17,11 +17,11 @@ func TestRedactURL(t *testing.T) {
 				Scheme: "http",
 				Host:   "host.tld",
 				Path:   "this:that",
 				User:   url.UserPassword("user", "password"),
 			},
-			want: "http://user:xxxxx@host.tld/this:that",
+			want: "http://user:redacted@host.tld/this:that",
 		},
 		{
 			name: "blank Password",
 			url: &url.URL{
 				Scheme: "http",
@@ -37,11 +37,11 @@ func TestRedactURL(t *testing.T) {
 				Scheme: "http",
 				Host:   "host.tld",
 				Path:   "this:that",
 				User:   url.UserPassword("", "password"),
 			},
-			want: "http://:xxxxx@host.tld/this:that",
+			want: "http://:redacted@host.tld/this:that",
 		},
 		{
 			name: "blank Username, blank Password",
 			url: &url.URL{
 				Scheme: "http",
@@ -58,10 +58,32 @@ func TestRedactURL(t *testing.T) {
 		{
 			name: "nil URL",
 			url:  nil,
 			want: "",
 		},
+		{
+			name: "non-blank SSH key in URL query parameter",
+			url: &url.URL{
+				Scheme:   "ssh",
+				User:     url.User("git"),
+				Host:     "github.com",
+				Path:     "hashicorp/go-getter-test-private.git",
+				RawQuery: "sshkey=LS0tLS1CRUdJTiBPUE",
+			},
+			want: "ssh://git@github.com/hashicorp/go-getter-test-private.git?sshkey=redacted",
+		},
+		{
+			name: "blank SSH key in URL query parameter",
+			url: &url.URL{
+				Scheme:   "ssh",
+				User:     url.User("git"),
+				Host:     "github.com",
+				Path:     "hashicorp/go-getter-test-private.git",
+				RawQuery: "sshkey=",
+			},
+			want: "ssh://git@github.com/hashicorp/go-getter-test-private.git?sshkey=",
+		},
 	}
 
 	for _, tt := range cases {
 		t := t
 		t.Run(tt.name, func(t *testing.T) {

Vulnerable code: 		ru.User = url.UserPassword(ru.User.Username(), "xxxxx")
			want: "http://user:xxxxx@host.tld/this:that",
			want: "http://:xxxxx@host.tld/this:that",
Fixed code: cmd/go-getter/go-getter
		ru.User = url.UserPassword(ru.User.Username(), "redacted")
	}
	q := ru.Query()
	if q.Get("sshkey") != "" {
		q.Set("sshkey", "redacted")
		ru.RawQuery = q.Encode()
			want: "http://user:redacted@host.tld/this:that",
			want: "http://:redacted@host.tld/this:that",
		{
			name: "non-blank SSH key in URL query parameter",
			url: &url.URL{
				Scheme:   "ssh",
				User:     url.User("git"),
				Host:     "github.com",
				Path:     "hashicorp/go-getter-test-private.git",
				RawQuery: "sshkey=LS0tLS1CRUdJTiBPUE",
			},
			want: "ssh://git@github.com/hashicorp/go-getter-test-private.git?sshkey=redacted",
		},
		{
			name: "blank SSH key in URL query parameter",
			url: &url.URL{
				Scheme:   "ssh",
				User:     url.User("git"),
				Host:     "github.com",
				Path:     "hashicorp/go-getter-test-private.git",
				RawQuery: "sshkey=",
			},
			want: "ssh://git@github.com/hashicorp/go-getter-test-private.git?sshkey=",
		},