mirror of
https://git.mirrors.martin98.com/https://github.com/actions/toolkit
synced 2025-11-19 02:31:07 +08:00
77 lines
2.4 KiB
TypeScript
77 lines
2.4 KiB
TypeScript
import {debug, setSecret} from '@actions/core'
|
|
|
|
/**
|
|
* Masks the `sig` parameter in a URL and sets it as a secret.
|
|
*
|
|
* @param url - The URL containing the signature parameter to mask
|
|
* @remarks
|
|
* This function attempts to parse the provided URL and identify the 'sig' query parameter.
|
|
* If found, it registers both the raw and URL-encoded signature values as secrets using
|
|
* the Actions `setSecret` API, which prevents them from being displayed in logs.
|
|
*
|
|
* The function handles errors gracefully if URL parsing fails, logging them as debug messages.
|
|
*
|
|
* @example
|
|
* ```typescript
|
|
* // Mask a signature in an Azure SAS token URL
|
|
* maskSigUrl('https://example.blob.core.windows.net/container/file.txt?sig=abc123&se=2023-01-01');
|
|
* ```
|
|
*/
|
|
export function maskSigUrl(url: string): void {
|
|
if (!url) return
|
|
try {
|
|
const parsedUrl = new URL(url)
|
|
const signature = parsedUrl.searchParams.get('sig')
|
|
if (signature) {
|
|
setSecret(signature)
|
|
setSecret(encodeURIComponent(signature))
|
|
}
|
|
} catch (error) {
|
|
debug(
|
|
`Failed to parse URL: ${url} ${
|
|
error instanceof Error ? error.message : String(error)
|
|
}`
|
|
)
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Masks sensitive information in URLs containing signature parameters.
|
|
* Currently supports masking 'sig' parameters in the 'signed_upload_url'
|
|
* and 'signed_download_url' properties of the provided object.
|
|
*
|
|
* @param body - The object should contain a signature
|
|
* @remarks
|
|
* This function extracts URLs from the object properties and calls maskSigUrl
|
|
* on each one to redact sensitive signature information. The function doesn't
|
|
* modify the original object; it only marks the signatures as secrets for
|
|
* logging purposes.
|
|
*
|
|
* @example
|
|
* ```typescript
|
|
* const responseBody = {
|
|
* signed_upload_url: 'https://blob.core.windows.net/?sig=abc123',
|
|
* signed_download_url: 'https://blob.core/windows.net/?sig=def456'
|
|
* };
|
|
* maskSecretUrls(responseBody);
|
|
* ```
|
|
*/
|
|
export function maskSecretUrls(body: Record<string, unknown> | null): void {
|
|
if (typeof body !== 'object' || body === null) {
|
|
debug('body is not an object or is null')
|
|
return
|
|
}
|
|
if (
|
|
'signed_upload_url' in body &&
|
|
typeof body.signed_upload_url === 'string'
|
|
) {
|
|
maskSigUrl(body.signed_upload_url)
|
|
}
|
|
if (
|
|
'signed_download_url' in body &&
|
|
typeof body.signed_download_url === 'string'
|
|
) {
|
|
maskSigUrl(body.signed_download_url)
|
|
}
|
|
}
|